microg/GmsCore · error · SecurityException

UID [

Error message

UID [

What it means

getAndCheckPackage resolves the package names owning the calling UID and throws this SecurityException if the resolved package differs from the suggestedPackageName argument. This is microG's implementation of the Play services package-identity check: an app may not claim a package name it does not actually own.

Source

Thrown at play-services-base/core/src/main/java/org/microg/gms/common/PackageUtils.java:260

    }

    @Nullable
    public static String getAndCheckPackage(@NonNull Context context, @Nullable String suggestedPackageName, int callingUid, int callingPid) {
        String packageName = packageFromProcessId(context, callingPid);
        if (packageName == null) {
            String[] packagesForUid = context.getPackageManager().getPackagesForUid(callingUid);
            if (packagesForUid != null && packagesForUid.length != 0) {
                if (packagesForUid.length == 1) {
                    packageName = packagesForUid[0];
                } else if (Arrays.asList(packagesForUid).contains(suggestedPackageName)) {
                    packageName = suggestedPackageName;
                } else {
                    packageName = packagesForUid[0];
                }
            }
        }
        if (packageName != null && suggestedPackageName != null && !packageName.equals(suggestedPackageName)) {
            throw new SecurityException("UID [" + callingUid + "] is not related to packageName [" + suggestedPackageName + "] (seems to be " + packageName + ")");
        }
        return packageName;
    }

    @Nullable
    @Deprecated
    public static String packageFromProcessId(@NonNull Context context, int pid) {
        ActivityManager manager = (ActivityManager) context.getSystemService(Context.ACTIVITY_SERVICE);
        if (manager == null) return null;
        if (pid <= 0) return null;
        List<ActivityManager.RunningAppProcessInfo> runningAppProcesses = manager.getRunningAppProcesses();
        if (runningAppProcesses != null) {
            for (ActivityManager.RunningAppProcessInfo processInfo : runningAppProcesses) {
                if (processInfo.pid == pid && processInfo.pkgList.length == 1) {
                    return processInfo.pkgList[0];
                }
            }
        }

View on GitHub (pinned to 157c9d86ac)

Solutions

1. Use context.getPackageName() (or the real application id from build.gradle) for the suggestedPackageName argument instead of a hardcoded string.
2. If the app uses sharedUserId, ensure the suggested name matches the package resolved for the shared UID.
3. After a rebrand/repackage, update all places that report the package name (manifest, build config, service calls).
4. Catch SecurityException and log both the resolved and suggested names to diagnose which identifier is stale.

Example fix

// before
String pkg = "com.example.oldapp";
PackageUtils.getAndCheckPackage(context, pkg, Process.myUid());

// after
String pkg = context.getPackageName();
PackageUtils.getAndCheckPackage(context, pkg, Process.myUid());

String real = context.getPackageName();
if (suggestedPackageName != null && !suggestedPackageName.equals(real)) {
    throw new IllegalArgumentException("suggestedPackageName '" + suggestedPackageName + "' != actual '" + real + "'");
}

try {
    return PackageUtils.getAndCheckPackage(context, suggestedPkg, callingUid);
} catch (SecurityException e) {
    Log.w(TAG, "Package identity mismatch, using real package", e);
    return context.getPackageName();
}

When it happens

Trigger: Calling a microG service with a package name (in metadata, extras, or an API argument) that differs from the actual calling app's package; a shared-UID/multi-process setup where getPackagesForUid returns a different package than suggested; a renamed/repackaged app still sending its old package name.

Common situations: Copy-pasted client code leaving another app's package name in constants; app rebranding without updating the reported package name; apps sharing a UID via android:sharedUserId resolving to the first package.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Missing required properties: token
• Missing required properties: scopes
• Missing required properties: account
• Access denied, missing google package permission for
• suggested UID [

AI-assisted analysis of microg/GmsCore@157c9d86ac (2026-09-06). Data as JSON: /api/errors/d9dd420a8e0640ce. Report an issue: GitHub.