{"record":{"id":"043adcb4560b9297","repo":"microg/GmsCore","slug":"access-denied-missing-google-package-permission-o","errorCode":null,"errorMessage":"Access denied, missing google package permission or GET_ACCOUNTS","messagePattern":"Access denied, missing google package permission or GET_ACCOUNTS","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"play-services-core/src/main/java/org/microg/gms/auth/AccountContentProvider.java","lineNumber":70,"sourceCode":"        return true;\n    }\n\n    @Nullable\n    @Override\n    public Bundle call(String method, String arg, Bundle extras) {\n        String suggestedPackageName = null;\n        if (SDK_INT > 19) {\n            suggestedPackageName = getCallingPackage();\n        }\n        String packageName = PackageUtils.getAndCheckCallingPackage(getContext(), suggestedPackageName);\n        boolean hasGooglePackagePermission = PackageUtils.callerHasGooglePackagePermission(getContext(), GooglePackagePermission.ACCOUNT);\n        if (!hasGooglePackagePermission) {\n            String[] packagesForUid = getContext().getPackageManager().getPackagesForUid(Binder.getCallingUid());\n            if (packagesForUid != null && packagesForUid.length != 0)\n                Log.w(TAG, \"Not granting extended access to \" + Arrays.toString(packagesForUid)\n                        + \", signature: \" + PackageUtils.firstSignatureDigest(getContext(), packagesForUid[0]));\n            if (getContext().checkCallingPermission(Manifest.permission.GET_ACCOUNTS) != PackageManager.PERMISSION_GRANTED)\n                throw new SecurityException(\"Access denied, missing google package permission or GET_ACCOUNTS\");\n        }\n        long identityToken = Binder.clearCallingIdentity();\n        try {\n            if (PROVIDER_METHOD_GET_ACCOUNTS.equals(method)) {\n                Bundle result = new Bundle();\n                Account[] accounts = null;\n                if (arg != null && (arg.equals(DEFAULT_ACCOUNT_TYPE) || arg.startsWith(DEFAULT_ACCOUNT_TYPE + \".\"))) {\n                    AccountManager am = AccountManager.get(getContext());\n                    accounts = am.getAccountsByTypeForPackage(arg, packageName);\n                    if (SDK_INT >= 26 && accounts != null && arg.equals(DEFAULT_ACCOUNT_TYPE)) {\n                        for (Account account : accounts) {\n                            if (am.getAccountVisibility(account, packageName) == AccountManager.VISIBILITY_UNDEFINED &&\n                                    (hasGooglePackagePermission || AuthPrefs.isAuthVisible(getContext()))) {\n                                Log.d(TAG, \"Make account \" + account + \" visible to \" + packageName);\n                                am.setAccountVisibility(account, packageName, VISIBILITY_VISIBLE);\n                            }\n                        }\n                    }","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/microg/GmsCore/blob/157c9d86ac46c195a86c2f15ab55c84036223f95/play-services-core/src/main/java/org/microg/gms/auth/AccountContentProvider.java#L52-L88","documentation":"AccountContentProvider.call() only serves callers that either hold a google-package signature permission or the GET_ACCOUNTS permission. If a calling app has neither, it throws SecurityException to prevent unauthorized account enumeration.","triggerScenarios":"A content-provider call() from an app whose UID lacks the microg google-package signature permission AND which has not been granted android.permission.GET_ACCOUNTS.","commonSituations":"Third-party apps querying the accounts provider without declaring GET_ACCOUNTS in their manifest; running on Android 6.0+ where GET_ACCOUNTS is a runtime permission not granted; signature permission not granted because the caller is not signed with the expected key.","solutions":["Declare <uses-permission android:name=\"android.permission.GET_ACCOUNTS\"/> in the calling app's manifest.","Request GET_ACCOUNTS at runtime (ActivityCompat.requestPermissions) before calling the provider.","If you are the privileged client, ensure your APK is signed with the key that grants the google package permission.","Use AccountManager APIs instead of calling the content provider directly."],"exampleFix":"// before\nBundle result = context.getContentResolver().call(uri, \"get_accounts\", null, extras);\n// after\nif (ContextCompat.checkSelfPermission(context, Manifest.permission.GET_ACCOUNTS) == PackageManager.PERMISSION_GRANTED) {\n    Bundle result = context.getContentResolver().call(uri, \"get_accounts\", null, extras);\n}","handlingStrategy":"validation","validationCode":"boolean ok = ContextCompat.checkSelfPermission(ctx, Manifest.permission.GET_ACCOUNTS) == PackageManager.PERMISSION_GRANTED; if (!ok) ActivityCompat.requestPermissions(activity, new String[]{Manifest.permission.GET_ACCOUNTS}, REQ);","typeGuard":null,"tryCatchPattern":"try { resolver.call(uri, method, arg, extras); } catch (SecurityException e) { // request GET_ACCOUNTS or use AccountManager }","preventionTips":["Declare GET_ACCOUNTS in the manifest","Request runtime permission on API 23+","Prefer AccountManager APIs over direct provider calls"],"tags":["android","security","permissions","content-provider"],"backgroundTag":"permission-denied","analyzedSha":"157c9d86ac46c195a86c2f15ab55c84036223f95","analyzedAt":"2026-09-06T17:27:33.892Z","contentChangedAt":"2026-09-06T17:27:33.892Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}