microg/GmsCore · error · SecurityException

Access denied, missing google package permission or GET_ACCO

Error message

Access denied, missing google package permission or GET_ACCOUNTS

What it means

AccountContentProvider.call() only serves callers that either hold a google-package signature permission or the GET_ACCOUNTS permission. If a calling app has neither, it throws SecurityException to prevent unauthorized account enumeration.

Source

Thrown at play-services-core/src/main/java/org/microg/gms/auth/AccountContentProvider.java:70

        return true;
    }

    @Nullable
    @Override
    public Bundle call(String method, String arg, Bundle extras) {
        String suggestedPackageName = null;
        if (SDK_INT > 19) {
            suggestedPackageName = getCallingPackage();
        }
        String packageName = PackageUtils.getAndCheckCallingPackage(getContext(), suggestedPackageName);
        boolean hasGooglePackagePermission = PackageUtils.callerHasGooglePackagePermission(getContext(), GooglePackagePermission.ACCOUNT);
        if (!hasGooglePackagePermission) {
            String[] packagesForUid = getContext().getPackageManager().getPackagesForUid(Binder.getCallingUid());
            if (packagesForUid != null && packagesForUid.length != 0)
                Log.w(TAG, "Not granting extended access to " + Arrays.toString(packagesForUid)
                        + ", signature: " + PackageUtils.firstSignatureDigest(getContext(), packagesForUid[0]));
            if (getContext().checkCallingPermission(Manifest.permission.GET_ACCOUNTS) != PackageManager.PERMISSION_GRANTED)
                throw new SecurityException("Access denied, missing google package permission or GET_ACCOUNTS");
        }
        long identityToken = Binder.clearCallingIdentity();
        try {
            if (PROVIDER_METHOD_GET_ACCOUNTS.equals(method)) {
                Bundle result = new Bundle();
                Account[] accounts = null;
                if (arg != null && (arg.equals(DEFAULT_ACCOUNT_TYPE) || arg.startsWith(DEFAULT_ACCOUNT_TYPE + "."))) {
                    AccountManager am = AccountManager.get(getContext());
                    accounts = am.getAccountsByTypeForPackage(arg, packageName);
                    if (SDK_INT >= 26 && accounts != null && arg.equals(DEFAULT_ACCOUNT_TYPE)) {
                        for (Account account : accounts) {
                            if (am.getAccountVisibility(account, packageName) == AccountManager.VISIBILITY_UNDEFINED &&
                                    (hasGooglePackagePermission || AuthPrefs.isAuthVisible(getContext()))) {
                                Log.d(TAG, "Make account " + account + " visible to " + packageName);
                                am.setAccountVisibility(account, packageName, VISIBILITY_VISIBLE);
                            }
                        }
                    }

View on GitHub (pinned to 157c9d86ac)

Solutions

1. Declare <uses-permission android:name="android.permission.GET_ACCOUNTS"/> in the calling app's manifest.
2. Request GET_ACCOUNTS at runtime (ActivityCompat.requestPermissions) before calling the provider.
3. If you are the privileged client, ensure your APK is signed with the key that grants the google package permission.
4. Use AccountManager APIs instead of calling the content provider directly.

Example fix

// before
Bundle result = context.getContentResolver().call(uri, "get_accounts", null, extras);
// after
if (ContextCompat.checkSelfPermission(context, Manifest.permission.GET_ACCOUNTS) == PackageManager.PERMISSION_GRANTED) {
    Bundle result = context.getContentResolver().call(uri, "get_accounts", null, extras);
}

boolean ok = ContextCompat.checkSelfPermission(ctx, Manifest.permission.GET_ACCOUNTS) == PackageManager.PERMISSION_GRANTED; if (!ok) ActivityCompat.requestPermissions(activity, new String[]{Manifest.permission.GET_ACCOUNTS}, REQ);

try { resolver.call(uri, method, arg, extras); } catch (SecurityException e) { // request GET_ACCOUNTS or use AccountManager }

When it happens

Trigger: A content-provider call() from an app whose UID lacks the microg google-package signature permission AND which has not been granted android.permission.GET_ACCOUNTS.

Common situations: Third-party apps querying the accounts provider without declaring GET_ACCOUNTS in their manifest; running on Android 6.0+ where GET_ACCOUNTS is a runtime permission not granted; signature permission not granted because the caller is not signed with the expected key.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Caller must hold $permission for location bypass
• Access denied, missing google package permission for
• suggested UID [
• suggested PID [
• UID [

AI-assisted analysis of microg/GmsCore@157c9d86ac (2026-09-06). Data as JSON: /api/errors/043adcb4560b9297. Report an issue: GitHub.