{"action":"created","issue":{"url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/144","repository_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore","labels_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/144/labels{/name}","comments_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/144/comments","events_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/144/events","html_url":"https://github.com/microg/android_packages_apps_GmsCore/issues/144","id":162078701,"number":144,"title":"GET_ACCOUNTS should be allowed for Google-signed apps on Marshmallow","user":{"login":"jimbo1qaz","id":913957,"avatar_url":"https://avatars.githubusercontent.com/u/913957?v=3","gravatar_id":"","url":"https://api.github.com/users/jimbo1qaz","html_url":"https://github.com/jimbo1qaz","followers_url":"https://api.github.com/users/jimbo1qaz/followers","following_url":"https://api.github.com/users/jimbo1qaz/following{/other_user}","gists_url":"https://api.github.com/users/jimbo1qaz/gists{/gist_id}","starred_url":"https://api.github.com/users/jimbo1qaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimbo1qaz/subscriptions","organizations_url":"https://api.github.com/users/jimbo1qaz/orgs","repos_url":"https://api.github.com/users/jimbo1qaz/repos","events_url":"https://api.github.com/users/jimbo1qaz/events{/privacy}","received_events_url":"https://api.github.com/users/jimbo1qaz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2016-06-24T05:30:36Z","updated_at":"2016-07-01T20:33:14Z","closed_at":null,"body":"Nexus 5X, PureNexus 6.0.1 June, Xposed FakeGApps.\r\n\r\n## Description\r\nAfter installing MicroG, I discovered that the Project Fi app crashes on startup.\r\n\r\nI ran a logcat, revealing that **MicroG** `AccountContentProvider.java` raised an exception:\r\n`Access denied, missing GET_ACCOUNTS or EXTENDED_ACCESS permission`\r\n\r\nI granted the GET_ACCOUNTS permission using `pm grant com.google.android.apps.tycho android.permission.GET_ACCOUNTS`, and the app *appears* to work properly.\r\n\r\n## Issue\r\nIn reality, MicroG should be allowing Project Fi to load, even without that permission.\r\n\r\nQuote Android docs (<https://developer.android.com/reference/android/Manifest.permission.html#GET_ACCOUNTS>):\r\n> **Note:** Beginning with Android 6.0 (API level 23), if an app shares the signature of the authenticator that manages an account, it does not need \"GET_ACCOUNTS\" permission to read information about that account. On Android 5.1 and lower, all apps need \"GET_ACCOUNTS\" permission to read information about any account.\r\n\r\nAs MicroG is imitating a Google-signed app, it should allow Google-signed apps to read accounts without that permission."},"comment":{"url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/comments/230041264","html_url":"https://github.com/microg/android_packages_apps_GmsCore/issues/144#issuecomment-230041264","issue_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/144","id":230041264,"user":{"login":"Lanchon","id":3977813,"avatar_url":"https://avatars.githubusercontent.com/u/3977813?v=3","gravatar_id":"","url":"https://api.github.com/users/Lanchon","html_url":"https://github.com/Lanchon","followers_url":"https://api.github.com/users/Lanchon/followers","following_url":"https://api.github.com/users/Lanchon/following{/other_user}","gists_url":"https://api.github.com/users/Lanchon/gists{/gist_id}","starred_url":"https://api.github.com/users/Lanchon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lanchon/subscriptions","organizations_url":"https://api.github.com/users/Lanchon/orgs","repos_url":"https://api.github.com/users/Lanchon/repos","events_url":"https://api.github.com/users/Lanchon/events{/privacy}","received_events_url":"https://api.github.com/users/Lanchon/received_events","type":"User","site_admin":false},"created_at":"2016-07-01T20:33:14Z","updated_at":"2016-07-01T20:33:14Z","body":"@mar-v-in thank you for your detailed response!\r\n\r\nIMHO, asking users to spoof all signatures of all apps that share a signature to patch a single app is undue burden on the user. not to mention, you can't install patched versions of apps from different sources without resigning them all yourself.\r\n\r\nand keep in mind that a change of signature currently requires wiping app data (unless you use xposed, which we don't want for security reasons (but i am forced to use anyway)), so that solution is not really workable.\r\n\r\nalso, one usage scenario you didn't envision is having one untouched single closed-source app with a 3rd party signature installed, and then installing a FLOSS spoofing the signature to overcome some restriction of the closed-source app.\r\n\r\nfor example, an app could store user data, but then not let you export your data, holding you hostage. a simple FLOSS app could overcome that by accessing the immoral app's database directly and freeing your data; but that requires level 2 signature spoofing.\r\n\r\n------\r\n\r\nand a couple of questions:\r\n\r\nQ1) if an app is granted \"extended access\" by virtue of its signature, will it be granted said access immediately and transparently? or will it go though a user UI request such as when an app requests the `org.microg.gms.EXTENDED_ACCESS` permission? \r\n\r\nQ2) and regardless of how the extended access permission is granted, when such powers are actually executed, say by requesting the list of accounts, will a UI \"account data access\" confirmation pop-up appear? or will the access be granted transparently?\r\n\r\nQ3) could Q2) be implemented by making the system behave as if a list of permissions were added to the permission lists of the apps that are granted EXTENDED_ACCESS instead of directly granting those accesses, triggering the usual UI confirmations?\r\n\r\nthanks!"}}
{"actor":{"display_login":"Lanchon"}}