Compatibility framework changes (Android 12)

ALLOW_TEST_API_ACCESS

Allows apps to access @TestApi APIs.

Note: This change is disabled by default and should only be used by platform test code.

ALWAYS_SANDBOX_DISPLAY_APIS

Forces the packages it is applied to always have Display API sandboxing applied, regardless of windowing mode. The Display APIs will always provide the app bounds.

To learn more about this change, see Display#getRealSize and getRealMetrics: deprecation and sandboxing.

BLOCK_FLAG_SLIPPERY

For apps running on Android 12, checks if FLAG_SLIPPERY is being used with any windows in the app. We expect that this flag is likely only used by the system components as it is an unsupported field. If so, it will be restricted.

BLOCK_GPS_STATUS_USAGE

For apps targeting Android 12 and higher, all GpsStatus API usage must be replaced with GnssStatus APIs.

BLOCK_IMMUTABLE_PENDING_INTENTS

For apps targeting Android 12 and higher, immutable PendingIntent objects that are passed into location APIs will generate an IllegalArgumentException.

BLOCK_PENDING_INTENT_SYSTEM_API_USAGE

For apps targeting Android 12 and higher, LocationRequest system APIs can't be used with PendingIntent location requests.

BLOCK_UNTRUSTED_TOUCHES

To preserve system security and a good user experience, Android 12 prevents apps from consuming touch events where an overlay blocks the app in an unsafe way.

To learn more about this change, see Untrusted touch events are blocked.

CAMERA_MIC_INDICATORS_NOT_PRESENT

Indicates that this device supports camera and microphone indicators. Will be false if present, because the CompatChanges#isChangeEnabled method returns true if the Change ID is not present.

CHANGE_ID_AUTH_STATE_DENIED

For client apps targeting Android 12 and higher, a SecurityException is thrown when they are in the denied authorization state and attempt to send a message to a nanoapp.

CHANGE_ID_SAMPLING_RATE_SENSORS_PERMISSION

For apps targeting Android 12 and higher, a SecurityException is thrown when they do not have HIGH_SAMPLING_RATE_SENSORS permission, run in debug mode, and request sampling rates that are faster than 200 Hz.

DELIVER_HISTORICAL_LOCATIONS

For apps targeting Android 12 and higher, location clients may receive historical locations (from before the present time) under some circumstances.

DOWNSCALED

This change is the gatekeeper of all per-app buffer downscaling changes. Disabling this change prevents the following scaling factors from working:

• DOWNSCALE_50
• DOWNSCALE_60
• DOWNSCALE_70
• DOWNSCALE_80
• DOWNSCALE_90

When this change is enabled for an app package, the app is forcibly resized to the highest enabled scaling factor. For example, 80% is used if both 80% and 70% are enabled.

DOWNSCALE_50

When DOWNSCALED is also enabled, enabling this change for a package forces the app to assume it's running on a display with 50% vertical and horizontal resolution of the real display.

DOWNSCALE_60

When DOWNSCALED is also enabled, enabling this change for a package forces the app to assume it's running on a display with 60% vertical and horizontal resolution of the real display.

DOWNSCALE_70

When DOWNSCALED is also enabled, enabling this change for a package forces the app to assume it's running on a display with 70% vertical and horizontal resolution of the real display.

DOWNSCALE_80

When DOWNSCALED is also enabled, enabling this change for a package forces the app to assume it's running on a display with 80% vertical and horizontal resolution of the real display.

DOWNSCALE_90

When DOWNSCALED is also enabled, enabling this change for a package forces the app to assume it's running on a display with 90% vertical and horizontal resolution of the real display.

DROP_CLOSE_SYSTEM_DIALOGS

To improve user control when interacting with apps and the system, the ACTION_CLOSE_SYSTEM_DIALOGS intent action is deprecated as of Android 12.

To learn more about this change, see Apps can't close system dialogs.

ENABLE_CHECKS_FOR_PRIVATE_FILES

Apps targeting Android 12 and higher can't insert or update private files using media provider.

ENABLE_DEFERRED_SCAN

Enable this option to defer the scan that is triggered as part of MediaProvider#update().

ENABLE_INCLUDE_ALL_VOLUMES

Enable this option to include database rows of files from a recently unmounted volume in MediaProvider#query.

ENABLE_RAW_MANAGE_EXTERNAL_STORAGE_ACCESS

Enable this option to allow apps holding the Manifest.permission.MANAGE_EXTERNAL_STORAGE permission to request raw external storage access.

ENABLE_RAW_SYSTEM_GALLERY_ACCESS

Enable this option to allow apps holding the android.app.role#SYSTEM_GALLERY role to request raw external storage access.

ENFORCE_NATIVE_SHARED_LIBRARY_DEPENDENCIES

Apps targeting Android 12 and higher need to declare dependencies to the public native shared libraries that are defined by the device maker using uses-native-library tag in its AndroidManifest.xml. If any of the dependencies can't be satisfied—for example, one of the dependencies doesn't exist—the package manager won't install the app. The dependency can be specified as optional using the android:required attribute in the tag, in which case failing to satisfy the dependency won't stop the installation.

Once installed, an app is provided with only the native shared libraries that are specified in the app manifest. Calling dlopen on a native shared library that doesn't appear in the app manifest will fail even if it actually exists on the device.

ENFORCE_STRICT_QUERY_BUILDER

For apps targeting Android 12 and higher, the SQLiteQueryBuilder now verifies all CalendarProvider2 query selections against malicious arguments.

FGS_BG_START_USE_EXEMPTION_LIST_CHANGE_ID

If set to false for a package, the system will not exempt it from FGS-BG-start, even if it's in ActiveServices.sFgsBgStartExemptedPackages.

FORCE_DISABLE_HEVC_SUPPORT

Force disable an app from supporting the HEVC media capability. Apps should declare their supported media capabilities in their manifest but this flag can be used to force an app into not supporting HEVC, hence forcing transcoding while accessing media encoded in HEVC. Setting this flag will override any OS level defaults for apps. It is disabled by default, meaning that the OS defaults take precedence. Setting this flag and FORCE_ENABLE_HEVC_SUPPORT is an undefined state and will result in the OS ignoring both flags.

FORCE_ENABLE_HEVC_SUPPORT

Force enable an app to support the HEVC media capability Apps should declare their supported media capabilities in their manifest but this flag can be used to force an app into supporting HEVC, hence avoiding transcoding while accessing media encoded in HEVC. Setting this flag will override any OS level defaults for apps. It is disabled by default, meaning that the OS defaults would take precedence. Setting this flag and FORCE_DISABLE_HEVC_SUPPORT is an undefined state and will result in the OS ignoring both flags.

FORCE_NON_RESIZE_APP

Forces the packages it is applied to to be non-resizable.

FORCE_RESIZE_APP

Forces the packages it is applied to to be resizeable. We only allow resizing in fullscreen windowing mode, but not forcing the app into resizeable multi-windowing mode.

HIDE_PROP_ICUBINARY_DATA_PATH

For apps targeting Android 12 and higher, removes access to the android.icu.impl.ICUBinary.dataPath property.

IS_BACKUP_SERVICE_ACTIVE_ENFORCE_PERMISSION_IN_SERVICE

For apps targeting Android 12 and higher, the BACKUP permission needed for isBackupServiceActive() is enforced on the service-side rather than client-side in BackupManager.

KEYSTORE_OPERATION_CREATION_MAY_FAIL

For apps targeting Android 12 and higher, keystore operation creation might now fail. Keystore used to work under the assumption that the creation of cryptographic operations always succeeds. However, the KeyMint backend has only a limited number of operation slots.

In order to keep up the appearance of "infinite" operation slots, the Keystore daemon would prune least recently used operations if there was no available operation slot. As a result, good operations could be terminated prematurely. This opened up AndroidKeystore up to denial-of-service (DoS) and unintended livelock. For example, if multiple apps woke up at the same time due to power management optimizations and attempted to perform crypto operations, they start terminating each others operations without making any progress.

To break out of livelocks and to discourage DoS attempts, we have changed the pruning strategy for such that it prefers clients that use few operation slots briefly. As a result, single operations that don't linger inactive for more than 5 seconds will almost always conclude unhampered by the pruning strategy. There are still some operations related to file system encryption that can prune even these operations, but those cases are extremely rare. As a side effect of this new pruning strategy operation, creation can now fail if the client has a lower pruning power than all of the existing operations.

Pruning strategy: To find a suitable candidate, we compute the malus for the caller and each existing operation. The malus is the inverse of the pruning power (caller) or pruning resistance (existing operation). For the caller to be able to prune an operation, it must find an operation with a malus higher than its own. For more details on the pruning strategy, see the implementation of operation.rs. On Android 11 (API level 30) and lower, KeyStore2 will poll the Keystore daemon for a free operation slot. For apps targeting Android 11 (API level 30) and lower, it will still look like cipher and signature object initialization always succeeds—however, it may take longer to get an operation. All Android versions benefit from fairer operation slot scheduling and a better chance to successfully conclude an operation.

LOW_POWER_EXCEPTIONS

For apps targeting Android 12 and higher, all LocationRequest objects marked as low power throw exceptions if the caller does not have the LOCATION_HARDWARE permission, instead of silently dropping the low power part of the request.

MISSING_EXPORTED_FLAG

For apps targeting Android 12 and higher, an explicit value must be specified for the android:exported attribute whenever an intent filter is defined.

To learn more about this change, see Safer exporting of components.

NATIVE_HEAP_ZERO_INIT

Enable automatic zero-initialization of native heap memory allocations.

NATIVE_MEMTAG_ASYNC

Enable asynchronous (ASYNC) memory tag checking in this process. This flag only affects hardware supporting the ARM Memory Tagging Extension (MTE).

NATIVE_MEMTAG_SYNC

Enables synchronous (SYNC) memory tag checking in this process. This flag only affects hardware supporting the ARM Memory Tagging Extension (MTE). If both NATIVE_MEMTAG_ASYNC and this option are enabled, this option takes precedence and MTE is enabled in SYNC mode.

NEVER_SANDBOX_DISPLAY_APIS

Forces the packages it is applied to never have Display API sandboxing applied for a letterbox or SCM activity. The Display APIs will continue to provide DisplayArea bounds.

To learn more about this change, see Display#getRealSize and getRealMetrics: deprecation and sandboxing.

NOTIFICATION_CANCELLATION_REASONS

Allows notification listeners to understand new cancellation reasons that are more specific.

NOTIFICATION_TRAMPOLINE_BLOCK

To improve app performance and UX, apps that target Android 12 cannot use services or broadcast receivers as notification trampolines.

To learn more about this change, see Notification trampolines cannot be created from services or broadcast receivers.

NULL_TELEPHONY_THROW_NO_CB

Used for checking if the target SDK version for the current process is Android 12 or higher.

Applies to the following methods:

• requestCellInfoUpdate(Executor, TelephonyManager.CellInfoCallback)
• setPreferredOpportunisticDataSubscription(int, boolean, Executor, Consumer)
• updateAvailableNetworks(List, Executor, Consumer)
• requestNumberVerification()
• setSimPowerStateForSlot()

OVERRIDE_MIN_ASPECT_RATIO

This change is the gatekeeper of all changes that force a given minimum aspect ratio. Enabling this change allows the following minimum aspect ratios to be applied:

• OVERRIDE_MIN_ASPECT_RATIO_LARGE
• OVERRIDE_MIN_ASPECT_RATIO_MEDIUM

When this change is enabled for an app package, the minimum aspect ratio given in the app's manifest is overridden to the largest enabled aspect ratio unless the app's manifest value is higher.

OVERRIDE_MIN_ASPECT_RATIO_LARGE

When OVERRIDE_MIN_ASPECT_RATIO is also enabled, enabling this change for a package sets the activity's minimum aspect ratio to a large value as defined by OVERRIDE_MIN_ASPECT_RATIO_LARGE_VALUE.

OVERRIDE_MIN_ASPECT_RATIO_MEDIUM

When OVERRIDE_MIN_ASPECT_RATIO is also enabled, enabling this change for a package sets the activity's minimum aspect ratio to a medium value as defined by OVERRIDE_MIN_ASPECT_RATIO_MEDIUM_VALUE.

PENDING_INTENT_EXPLICIT_MUTABILITY_REQUIRED

For apps targeting Android 12 and higher, you must specify the mutability of each PendingIntent object that your app creates. This additional requirement improves your app's security.

To learn more about this change, see Pending intents must declare mutability.

RATE_LIMIT_TOASTS

Enables rate limiting on the number of Toast.show() calls to prevent overburdening the user with too many toasts in a limited time. Any attempt to show more toasts than allowed in a certain time frame will result in the toast being discarded.

REQUIRE_EXACT_ALARM_PERMISSION

For apps targeting Android 12 and higher, apps must have the new Manifest.permission.SCHEDULE_EXACT_ALARM permission in order to use setExactAndAllowWhileIdle(int, long, PendingIntent) and setAlarmClock(AlarmClockInfo, PendingIntent).

SECURITY_EXCEPTION_ON_INVALID_ATTRIBUTION_TAG_CHANGE

For apps targeting Android 12 and higher, enforces that all attributionTags sent to noteOp(String, int, String), noteProxyOp(String, String), and startOp(String, int, String) are defined in the manifest of the package that is specified as a parameter of the methods.

To enable this change, both the package calling noteOp(String, int, String) as well as the package specified as a parameter of the method must have this change enabled.

SELINUX_LATEST_CHANGES

For apps targeting Android 12 and higher, opts in to the latest SELinux changes. Turning this change off for an app targeting Android 12 or higher is a no-op. Has no effect for apps that use a shared user id.

SELINUX_R_CHANGES

This change gates an app's access to the untrusted_app_R-targetSDk SELinux domain. This is one of the foundational changes in the compatibility framework that allows apps to toggle other changes that are gated by targetSdkVersion without changing their app's targetSDKVersion. For this reason, you should not disable this change for an app that targets Android 11, or the app will not function.

This change has no effect for apps that use a shared user ID.

SETTINGS_API_V2

The new user preference API for verifying domains marked android:autoVerify="true" in AndroidManifest.xml intent filters is not yet implemented in the current platform preview. For now, it is possible to preview the new user preference changes by enabling this change using adb shell pm set-app-links-user-selection and similar commands.

THROW_EXCEPTION_ON_REQUIRE_INSTALL_PACKAGES_TO_ADD_INSTALLER_PACKAGE

For apps targeting Android 11 (API level 30) and higher, adding an installer package name to a package that does not have one set now requires the INSTALL_PACKAGES permission. If the caller targets Android 11 (API level 30), a SecurityException is thrown. Otherwise, the request fails silently. In both cases, and regardless of whether this change is enabled, the installer package remains unchanged.