READ_PHONE_STATE Permission isn’t in my Manifest or Plugins!

Unity automatically adds the READ_PHONE_STATE permission into builds when either:

• Your scripts contain code which require the permission.
• The target SDK version isn’t set (or set below 4) which causes the manifest merger to assume the SDK version is lower than 4 and the system will implicitly grant the READ_PHONE_STATE permission to the app. (in later versions of Unity 5 and Unity 2017 the target SDK version is now set in the editor making managing it much easier)
• You have a plugin in your project which has its own manifest file requesting the permission (the manifest can be contained within your jar or aar files, they’re not always simply in your project) – Note that if a plugin is requesting a permission then it’s probably required and may cause issues if removed, check the plugin documentation if you’re unsure!

Code which causes Unity to automatically add the permission

In the case of your scripts containing code which need the permission. Unity automatically adds the permission when using functions which require it.

Some SystemInfo properties such as SystemInfo.deviceUniqueIdentifier require the READ_PHONE_STATE permission so referencing it in a script will force Unity to add it.

As an alternative to SystemInfo.deviceUniqueIdentifier when needing a unique device identifier and it’s not important to keep it the same between wiping save data. Consider generating a unique value based on System.DateTime.Now.Ticks and storing in the playerprefs instead.

Why am I asked to allow/deny the permission at app launch?

Starting with Android 6.0 the user was given more control over permissions apps were allowed to use at runtime; rather than a blanket list of confusing permission being included with the app at installation. Permissions which are prompted for the user to allow are classified as dangerous permissions as they can allow the app to access sensitive data. (in this case READ_PHONE_STATE can allow reading of the phone number, call statuses or list phone accounts registered on the device)

If you want to manually control when the permissions are requested at runtime rather than all dangerous permissions just being prompted at startup then you can add:
<meta-data android:name=”unityplayer.SkipPermissionsDialog” android:value=”true” />
Between the <application> tags of your manifest file.

With the permission dialog skipped all dangerous permissions will remain defaulted as denied! But this allows you to request permissions manually when you need them, rather than all at once at app launch. (However note that you’ll either need to write a Java plugin yourself to control this or find an already built plugin from the store such as Android Buddy which fits this exact purpose!)

Learn more about the READ_PHONE_STATE android permission!

You can read more about the READ_PHONE_STATE permission on the android developer site at https://developer.android.com/reference/android/Manifest.permission.html#READ_PHONE_STATE

[출처]

https://www.unity3dtips.com/read_phone_state-permission-android/

Easy Way

I think this easier approach applies if your Unity project is being built with gradle. If it isn't, here is one more reason to upgrade.

Also, a big shout-out to an article called, Hey, Where Did These Permissions Come From?)

1. Build Your Project
2. Open the file /path/to/my/project/Temp/gradleOut/build/outputs/logs/manifest-merger-release-report.txt
3. Profit!
4. Search the file for the name of your permission, and it'll show you where it came from.

Here is part of the file, where I'm looking for the WRITE_EXTERNAL_STORAGE permission.

uses-permission#android.permission.WRITE_EXTERNAL_STORAGE ADDED from /Users/clinton/Projects/<<ProjectName>>/Temp/gradleOut/src/main/AndroidManifest.xml:7:3-79 MERGED from [gradleOut:IronSource:unspecified] /Users/clinton/Projects/<<ProjectName>>/Temp/gradleOut/IronSource/build/intermediates/bundles/default/AndroidManifest.xml:13:5-81 android:name ADDED from /Users/clinton/Projects/<<ProjectName>>/Temp/gradleOut/src/main/AndroidManifest.xml:7:20-76

Hard Way

There are three ways permissions get added to your project.

1. They are specified in an Android Manifest file.
2. They are specified in library (a .aar file).
3. Unity adds the permission when you use a certain feature. (Added)

My examples use command-line tools on a Mac. I don't know Windows equivalents, but it is possible to find and run unix tools there (using the linux subsystem for windows 10, cygwin, custom binaries, etc.)

1. Find all permissions used in (uncompressed) Android Manifests.

cd /path/to/my/project/Assets grep -r "uses-permission" --include "AndroidManifest.xml" .

This will find all files named AndroidManifest in the current folder (.) or any of its subfolders (-rtells it to search recursively) and spit out any line with the words 'uses-permission'.

In my current project, I get output something like this:

./Plugins/Android/AndroidManifest.xml: <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> ./Plugins/Android/AndroidManifest.xml: <uses-permission android:name="android.permission.INTERNET" /> ./Plugins/Android/AndroidManifest.xml: <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" /> ./Plugins/Android/AndroidManifest.xml: <uses-permission ./Plugins/Android/IronSource/AndroidManifest.xml: <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> ./Plugins/Android/IronSource/AndroidManifest.xml: <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

2. Find the permissions required in Android Libraries

Your project likely contains android libraries (.aar files) and java archives (.jar files). Some android libraries contain an android manifest and specify permissions needed to use the library. (I don't think .jar files actually do this, but .aar files absolutely do). Both .aar and .jar files are .zip files, with a different extension and with specific metadata in specific places.

Find them by running:

find . -iname "*.?ar" -print -exec zipgrep "uses-permission" "{}" "AndroidManifest.xml" ";" 2> /dev/null

Here's what this does. It finds any file (in the current folder (.) and its subfolders) has an extension of (something) a r, thus .jar, or .aar (-name "*.?ar"). It outputs the archive's file name (-print). It then runs zipgrep (-exec). Zipgrep is told to search through any files in the archive ({}) named "AndroidManifest.xml", and output any line with the words "uses-permission". We then pipe the errors to the bit bucket (2> /dev/null) so we don't see lots of errors about archives that don't have android manifests in them.

An example output looks like this:

./OneSignal/Platforms/Android/onesignal-unity.aar AndroidManifest.xml: <uses-permission android:name="android.permission.INTERNET" /> AndroidManifest.xml: <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" /> AndroidManifest.xml: <uses-permission android:name="android.permission.WAKE_LOCK" /> AndroidManifest.xml: <uses-permission android:name="android.permission.VIBRATE" /> ... ./Plugins/Android/android.arch.core.common-1.1.0.jar ./Plugins/Android/android.arch.core.runtime-1.1.0.aar ./Plugins/Android/android.arch.lifecycle.common-1.1.0.jar ... ./Plugins/Android/com.google.android.gms.play-services-gcm-11.8.0.aar AndroidManifest.xml: <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" /> AndroidManifest.xml: <uses-permission android:name="android.permission.INTERNET" /> ./Plugins/Android/com.google.android.gms.play-services-gcm-license-11.8.0.aar ./Plugins/Android/com.google.android.gms.play-services-iid-11.8.0.aar AndroidManifest.xml: <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" /> AndroidManifest.xml: <uses-permission android:name="android.permission.INTERNET" /> ./Plugins/Android/com.google.android.gms.play-services-iid-license-11.8.0.aar ...

The filenames all start with periods. I can thus see, for example, that the onesignal-unity.aar sets several permissions, several .jar files were searched with no permissions inside them, and some of the play services libraries specify permissions.

If I needed to change a library, I could rename the .aar to .zip, extract it, edit it, compress it, and rename it back. (It isn't necessarily wise to change the permissions inside a library, but possible.)

3. Unity Adds the Permission

I didn't have anything to add on this; as said above, if you use the Microphone API, Unity will add a permission for you so your app will work.

However, I've since realized that you can do the following:

• bring up the Build Settings for Android
• tick the 'Export Project' box
• Export the project, noting the location
• go to /my/project/export/src/main/AndroidManifest.xml. This is what Unity emits for the android manifest (before google's tools do all the merging).
• compare it (using your favourite diff tool) to Assets/plugins/Android/AndroidManifest.xml; the differences come from Unity.

[출처]

https://stackoverflow.com/questions/40931058/how-to-find-source-of-a-permission-in-unity-android

[추가]

Unity v5.6.7, Android SDK 최신 버전에서 READ_PHONE_STATE 권한을 제거 했는데도 계속 추가되는 문제가 있어서 알아본 결과 Android SDK 최신 버전에서 필요하다고 판단되면 READ_PHONE_STATE를 강제로 추가하고 있다.

(Unity 최신버전(현재 Unity 2018이상 버전)에서는 해당 버그가 수정된 듯 하다.)

내 경우는 SystemInfo.deviceUniqueIdentifier를 사용하게 되면서 필요하다고 판단해서 READ_PHONE_STATE를 추가시키고 있었다.

아래 설명대로 Android SDK 25.2.5 버전에서는 강제로 추가하는 문제가 없어서 SDK 버전을 되돌렸는데

Manifest Merge 관련 문제가 많이 나와서(최신 Android SDK에서는 자동 정리해주는 중복 Manifest 관련 문제를 25.2.5에서는 자동으로 해결해주지 못해서 직접 수정함) 문제되는 aar 파일 안의 AndroidManifest 파일을 모두 수정해서 해결 했다.

한 10개정도 수정한 듯..

-------------------------------------------------

Steps to reproduce:

1) Update SDK to the latest version (26.0.2) 
2) Download attached project 'Repo.zip' and open in Unity 
3) Build .apk file 
4) Open 'AndroidManifest.xml' file (Temp/StagingArea/AndroidManifest.xml)

Expected result:READ_PHONE_STATE permission should not be added in the AndroidManifest.xml (check attachment 'AndroidManifest_created_with_26.0.2.xml') 
Actual result: READ_PHONE_STATE permission is added in the AndroidManifest.xml (check attachment 'AndroidManifest_created_with.25.2.3.xml')

Reproduced with: 
5.5.4p1, 5.6.2p1, 2017.1.0f1, 2017.2.0b1

Note: READ_PHONE_STATE permission wasn't added using 25.2.5 sdk

RESOLUTION: By design. The project includes a plugin (com.nerd.TapdaqUnityPlugin) which does not specify targetSdkVersion in its manifest. Thus android manifest merger correctly assumes that the SDK version is lower than 4 and implicitly grants the READ_PHONE_STATE permission. See https://developer.android.com/reference/android/Manifest.permission.html#READ_PHONE_STATE. The difference between 25.2.5 and 26.0.2 SDKs is that in the latter we use different manifest merger implementation which is more strict.

[출처]

https://issuetracker.unity3d.com/issues/android-read-phone-state-permission-is-added-in-the-androidmanifest-dot-xml-file-using-latest-26-dot-0-2-sdk

[링크] https://brunch.co.kr/@oemilk/102

표 1. 위험한 권한 및 권한 그룹.

권한 그룹권한

[출처] https://developer.android.com/guide/topics/security/permissions.html?hl=ko#normal-dangerous)

[링크]

https://mentum.tistory.com/150

hello,

From that post : http://forum.unity3d.com/threads/how-can-you-add-items-to-the-xcode-project-targets-info-plist-using-the-xcodeapi.330574/ by modifying a bit the script i got that :

     [PostProcessBuild]
     public static void ChangeXcodePlist(BuildTarget buildTarget, string pathToBuiltProject) 
     {  
         if (buildTarget == BuildTarget.iOS) 
         {
             // Get plist
             string plistPath = pathToBuiltProject + "/Info.plist";
             PlistDocument plist = new PlistDocument();
             plist.ReadFromString(File.ReadAllText(plistPath));
             
             // Get root
             PlistElementDict rootDict = plist.root;
             
             // Change value of CFBundleVersion in Xcode plist
             var buildKey = "UIBackgroundModes";
             rootDict.CreateArray (buildKey).AddString ("remote-notification");
             
             // Write to file
             File.WriteAllText(plistPath, plist.WriteToString());
         }
     }

i just did it, it seems to work, need further test though.

Edit : Note that the script should be in Assets/Editor folder. Edit 2 : i created i string it should be a array, i changed the code.

[출처] https://answers.unity.com/questions/1066927/postprocessing-ios-activate-background-mode-for-pu.html

[사용도구]

Unity 5.6.7

Xcode 10.2.1

최근 iOS빌드에서 XCode-Capabilities-Push Notifications를 수동으로 ON 시켜야 되는 문제가 귀찮아서 자동으로 하는 방법을 찾아보고 정리해둠.

(유니티 5.x에서 되는 방법을 찾느라 이래저래 삽질을..)

[순서]

1) https://bitbucket.org/Unity-Technologies/xcodeapi 소스 다운로드.

2) 다운로드 받은 소스를 유니티 해당 프로젝트의 Editor 폴더 아래 추가

   나의 경우는 ../Assets/Editor/XCodeApi 아래에 추가. 

   2-1) Xcode.Tests는 에러나서 제거 함.(2017 이후 버전 API를 사용하는 듯 함)

3) iOS PostProcessBuild 소스에 PBXCapabilityType.PushNotifications 추가(AddCapability)

using System.IO;
using UnityEngine;
using UnityEditor;
using UnityEditor.iOS.Xcode;
using UnityEditor.Callbacks;
using System.Collections;

public class XCodeSettingsPostProcesser
{

    [PostProcessBuild]
    public static void OnPostprocessBuild(BuildTarget buildTarget, string pathToBuiltProject)
    {
        // Stop processing if targe is NOT iOS
        if (buildTarget != BuildTarget.iOS)
        {
            return;
        }

            /// Initialize PbxProject
            var projectPath = PBXProject.GetPBXProjectPath(pathToBuiltProject);
            PBXProject pbxProject = new PBXProject();
            pbxProject.ReadFromFile(projectPath);
            // Unity 2019 대응
#if UNITY_2019_3_OR_NEWER
            //string targetGuid = pbxProject.GetUnityFrameworkTargetGuid();
            string strMainTargetGuid = pbxProject.GetUnityMainTargetGuid();
            string strFrameworkTargetGuid = pbxProject.GetUnityFrameworkTargetGuid();
#else
            string targetGuid = pbxProject.TargetGuidByName("Unity-iPhone");
#endif

        // Add push notifications as a capability on the target
        pbxProject.AddCapability(targetGuid, UnityEditor.iOS.Xcode.Custom.PBXCapabilityType.PushNotifications);

        // Apply settings
        File.WriteAllText(projectPath, pbxProject.WriteToString());
    }
}

    3-1) 주의사항

         기존 PBXProject는 UnityEditor.iOS.Xcode.PBXProject인데, 추가 된 플러그인을 사용하기 위해 UnityEditor.iOS.Xcode.Custom.PBXProject로 변경필요.

         예1) UnityEditor.iOS.Xcode.PBXProject -> UnityEditor.iOS.Xcode.Custom.PBXProject

         예2) UnityEditor.iOS.Xcode.PBXCapabilityType -> UnityEditor.iOS.Xcode.Custom.PBXCapabilityType

4) entitlements 생성을 위해 아래 클래스를 Editor 폴더에 추가

    (entitlements 파일 내용을 스크립트 내부에 넣어서 생성해서 별도의 파일 추가를 안해도 돼서 편한 듯)

using UnityEditor;
 using UnityEditor.Callbacks;
 using UnityEngine;
 using System.IO;
 using UnityEditor.iOS.Xcode;
 
 public class EntitlementsPostProcess
 {
     private const string entitlements = @"
     <?xml version=""1.0"" encoding=""UTF-8\""?>
     <!DOCTYPE plist PUBLIC ""-//Apple//DTD PLIST 1.0//EN"" ""http://www.apple.com/DTDs/PropertyList-1.0.dtd"">
     <plist version=""1.0"">
         <dict>
             <key>aps-environment</key>
             <string>development</string>
         </dict>
     </plist>";
     
     [PostProcessBuild]
     public static void OnPostProcess(BuildTarget buildTarget, string buildPath)
     {
         if (buildTarget != BuildTarget.iOS) return;
 
         var file_name = "unity.entitlements";
         var proj_path = PBXProject.GetPBXProjectPath(buildPath);
         var proj = new PBXProject();
         proj.ReadFromFile(proj_path);
 
         // target_name = "Unity-iPhone"
         var target_name = PBXProject.GetUnityTargetName();
         var target_guid = proj.TargetGuidByName(target_name);        
         var dst = buildPath + "/" + target_name + "/" + file_name;
         try
         {
             File.WriteAllText(dst, entitlements);
             proj.AddFile(target_name + "/" + file_name, file_name);
             proj.AddBuildProperty(target_guid, "CODE_SIGN_ENTITLEMENTS", target_name + "/" + file_name);
             proj.WriteToFile(proj_path);
         }
         catch (IOException e)
         {
             Debug.LogWarning($"Could not copy entitlements. Probably already exists. ({e})");
         }
     }
 }

[1) 참조] https://bitbucket.org/Unity-Technologies/xcodeapi

[3) 참조] https://qiita.com/fullcorder/items/b82c48022acd0b4ff957

[4) 참조] https://answers.unity.com/questions/1224123/enable-push-notification-in-xcode-project-by-defau.html

[링크]

http://naver.me/FIj7Ocof

XcodeのCapabilityの各種設定をPostProcessBuildで行う方法です。
Pushの設定などを有効にするアレです。

ざっくり流れ

In-App Purchaseなどentitlementsファイルが不要なcapabilityの場合

1. Unityのリポジトリから, 最新のXcode Manipulation API(以下Xcode API)を持ってくる
2. 既存のプロジェクトにインポートできるように修正する
3. 最新のAPIでPostProcessBuildのScriptを書く

iCloudなどentitlementsファイルが必要なcapabilityの場合

1. 一旦先にビルドしてXcodeProjectを作成する
2. capabilityを設定し, entitlementsファイルを作成する
3. PostProcessBuildでentitlementsファイルとビルドプロパティを追加する
4. 以後entitlements file不要な場合に合流する

詳細な流れ

entitlementsファイルのいらないcapabilityの場合

Unityのリポジトリから, 最新のXcode APIを持ってくる

• https://bitbucket.org/Unity-Technologies/xcodeapi のリポジトリに行きます。
• ライセンスファイルを読みライセンスを理解します
• ブランチstableを取得します Revision 102

• リポジトリ内のXcodeフォルダをデスクトップなど作業環境にコピーします
• ターミナルでXcodeディレクトリに移動し, 下記のコマンドでC#のソースコードのnamespaceを変更します.仮に変更後のnamespaceをUnity2017.iOS.Xcodeとします

$ pwd
Users/fullcorder/Desktop/Xcode 
$ find . -name '*.cs' | xargs sed -i "" 's/UnityEditor.iOS.Xcode/Unity2017.iOS.Xcode/g'

• Xcode/Propertiesディレクトリをは不要なので削除します
• UnityプロジェクトのEditorディレクトリにXcodeフォルダごとインポートします

PostProcessBuildスクリプトを作成し下記のようにPBXProject#AddCapabilityを使って追加します

Unity2017.1のリファレンス
https://docs.unity3d.com/2017.1/Documentation/ScriptReference/iOS.Xcode.PBXProject.AddCapability.html

[PostProcessBuild]
public static void AddCapability(BuildTarget buildTarget, string path)
{
    if(EditorUserBuildSettings.activeBuildTarget != BuildTarget.iOS)
    {
        return;
    }

    string projPath = path + "/Unity-iPhone.xcodeproj/project.pbxproj";

    var proj = new PBXProject();
    proj.ReadFromString(File.ReadAllText(projPath));

    string target = proj.TargetGuidByName(TargetGroup);

    proj.AddCapability(target, PBXCapabilityType.PushNotifications);
    proj.AddCapability(target, PBXCapabilityType.InAppPurchase);

    File.WriteAllText(projPath, proj.WriteToString());
}

• 以上ですあとはビルドすればOKです

entitlementsファイルが必要なcapabilityの場合

entitlementsファイルが必要な場合は, entitlementsファイルを作成したものをPostProcessBuildで追加し、あとはentitlementsファイルが不要な場合に合流します

entitlementsファイルを作成

• UnityでiOSビルドしてXcodeProjectを吐き出します
• Capabilityタブに行き, Pushなどをこうなりたい状態, PostProcessBuild後で設定後の形にします
• entitlementsファイルがXcodeプロジェクト内に作成されるので取り出してUnityProjectにインポートします
• Unityフォーラムの下記ポストからEntitlementsPostProcess.csをDLしてUnityにインポートします

https://forum.unity3d.com/threads/how-to-put-ios-entitlements-file-in-a-unity-project.442277/

• EntitlementsPostProcess.csのSerializeFieldであるEntitlements Fileにentitlementsファイルを設定します
• 以上でentitlementsファイル追加が完了します

以後、前述の手順と合わせてビルドすると無事, 設定反映したになっていると思います
(Plist編集は別途スクリプト書いてください)

その他

Unity2017からは多分使えるAPIなので、長いプロジェクトの場合, プラットフォーム依存コンパイルでUnity5のみ限定して今回変更したnamespaceを使うようにすると良いと思います。

環境

macOS Sierra
Unity 5.5.3f1
Xcode 8.3.2

参考 
https://bitbucket.org/Unity-Technologies/xcodeapi
https://forum.unity3d.com/threads/how-to-put-ios-entitlements-file-in-a-unity-project.442277/

[출처] https://qiita.com/fullcorder/items/b82c48022acd0b4ff957