security - How to manage installation from Unknown Sources in Android Oreo?

Question

In Android Oreo (8.0), several changes where made on how to allow the installation of apps from Unknown Sources (from the user's point of view) and to the process of getting permission to install them (from the developer's point of view).

Since I found it particularly hard to find all the steps necessary on the developer side, I thought it to be useful to ask here for the solution and answer the question myself, now that I found the answers, for future reference to those, who are facing the same obstacles.

The answer will include the following questions:

1. How to check whether I'm allowed to request a package install?
2. What exact permission do I have to request?
3. How can I prompt the user to grant this permission?
4. How do I prompt the user to install a specified .apk?

(If I still miss anything here, I'd be grateful for any additional answers or comments pointing that out.)

Answer 1

For starters, your application needs to declare a targetSdkVersion of 26 (API level of Android Oreo) or higher in your build.gradle or AndroidManifest.xml for all this to work.

Then on to answer the questions above:

1. How to check whether I'm allowed to request a package install?

You can check this using getPackageManager().canRequestPackageInstalls() anywhere in your Activity's code. Note that this method always returns false, if you don't declare the appropriate permission or target the wrong SDK version.

2. What exact permission do I have to request?

You have to declare Manifest.permission.REQUEST_INSTALL_PACKAGES in your AndroidManifest.xml, like so:

    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />

3. How can I prompt the user to grant this permission?

You can send the user to the appropriate destination, with Intent ACTION_MANAGE_UNKNOWN_APP_SOURCES:

startActivity(new Intent(android.provider.Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES));

You may also send the user more directly to the specific setting for your application, with:

startActivity(new Intent(android.provider.Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES, Uri.parse("package:your.application.package")));

4. How do I prompt the user to install a specified .apk?

Once you made sure you are granted the appropriate permission, you can prompt the user to install your .apk file anywhere in your Activity's code (where this refers to your Activity's Context), using:

Intent intent = new Intent(Intent.ACTION_INSTALL_PACKAGE);
intent.setDataAndType(FileProvider.getUriForFile(this, "your.application.package.fileprovider", new File("/path/to/your/apk")), "application/vnd.android.package-archive");
intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);

startActivity(intent);

You may also add intent.putExtra(Intent.EXTRA_RETURN_RESULT, true) and start with startActivityForResult(Intent, int), if you want to know if the installation succeeded, was cancelled or failed.

For information on how to correctly get your .apk file's Uri, see FileProvider.