Android 11: one-time grants, scoped storage

Android 11 is the release where a permission could last for one session. Camera, microphone and location requests gained “Only this time”, and apps nobody opened for months lost their grants. For developers it closed the scoped storage opt-out and hid the list of installed apps from apps targeting API 30.

At a glance

Google released Android 11 and pushed its source to AOSP on 8 September 2020, starting with the Pixel 2, 3, 3a, 4 and 4a. Google’s announcement also named OnePlus, Xiaomi, OPPO and realme phones. The first phones sold with Android 11 were vivo’s V20, which went on sale in Southeast Asia on 30 September. Google announced its own, the Pixel 5 and Pixel 4a (5G), the same day.

The road there was a month longer than planned. The first developer preview came out on 19 February 2020. In May, Google added a fourth preview and moved Beta 1 and every later milestone back about a month. It then postponed the 3 June beta event “to allow people to focus on important discussions around racial justice”, and released Beta 1 on 10 June without one. Each preview and beta has its own part below this overview.

Dave Burke, Android’s VP of engineering, told the All About Android podcast in July 2020 that his team called the release “RVC”, for Red Velvet Cake. He said the name would not appear outside Google. The SDK constant is just R, and build IDs start with R (RP1A.200720.009 was the first Pixel build).

What it brought

• Conversations. Messaging notifications get their own section at the top of the shade. Users can mark a conversation as priority, per contact rather than per app.
• Bubbles. Floating chat windows, experimental behind a developer option in Android 10, are open to all apps. An app targeting API 30 only gets bubbles for notifications linked to a shortcut.
• Device controls. A long press on the power button shows controls for smart home devices. Apps add theirs with ControlsProviderService.
• Media controls. Players move into Quick Settings, in a swipeable carousel that can resume recent sessions, with an output switcher for speakers and headphones.
• Screen recording. A built-in recorder in Quick Settings, with audio from the microphone, the device or both.
• Wireless debugging. adb connects over Wi-Fi without a USB cable, after pairing with a code (adb pair ipaddr:port) or a QR code from Android Studio.
• 5G APIs. Apps can tell when the user is on 5G (TelephonyDisplayInfo), whether the connection is temporarily unmetered (NET_CAPABILITY_TEMPORARILY_NOT_METERED), and its estimated bandwidth. The emulator gained a 5G network setting in version 30.0.22.
• Developer tools. Data access auditing (see below), app exit reasons (ApplicationExitInfo), per-change compatibility toggles, adb install --incremental for large APKs, and more Kotlin nullability annotations.
• Smaller additions. Synchronized keyboard animations (WindowInsetsAnimation.Callback), waterfall and hinge-angle APIs, NNAPI 1.3, low-latency decoding in MediaCodec, an NDK image decoder, and wireless Android Auto on compatible cars.
• More APIs. An NDK Thermal API reports when the device is heating up, so a game can cut its load before the CPU throttles. A CallScreeningService can read the STIR/SHAKEN verification status of an incoming call. ImageDecoder.decodeDrawable() returns an AnimatedImageDrawable for an HEIF file with several frames, such as a burst photo.
• Small things users noticed. A notification history, off by default, keeps “Recently dismissed” notifications that still open their app, and those from the “Last 24 hours”. Apps can be pinned to the top of the share sheet. Dark theme can follow a schedule or sunset. A Wi-Fi network can be saved with “Auto-connect” off.

Security and privacy

• Data access auditing. An app registers AppOpsManager.OnOpNotedCallback and is told each time its own code, or a library inside it, touches private data. Attribution tags name the part of the app that made the call.
• Scudo. Native heap allocations use the Scudo hardened allocator, except on low-memory devices. Crashes it catches show up as Scudo ERROR:.
• fdsan aborts. The file descriptor sanitizer added in Android 10 now stops the process on a double close or use after close, instead of logging.
• Heap pointer tagging. For apps targeting 30, heap pointers carry a tag in their top byte, to prepare for Arm’s Memory Tagging Extension.
• Mainline. Google more than doubled the number of system modules it can update through Google Play system updates, with 12 new ones.
• Hardened identifiers. getIccId() returns an empty string. App usage stats move to credential-encrypted storage and stay unreadable until the user unlocks the device.
• Platform. The Generic Kernel Image (GKI) moves SoC support out of the core kernel into modules. Virtual A/B brings seamless updates with less storage. GWP-ASan runs in system apps to catch heap bugs.
• Resume-on-Reboot. After a reboot to install an OTA update, the device can unlock credential-encrypted storage for every app, including apps without Direct Boot support, so notifications arrive before the user enters the PIN. Devices need the android.hardware.reboot_escrow feature for it.

Permissions

Three changes reach every app, whatever it targets:

• One-time permissions. The camera, microphone and location dialogs offer “While using the app”, “Only this time” and “Deny”. A one-time grant lasts while the activity is visible and a short while after the app goes to the background, or until a foreground service started from the visible activity stops.
• Two denials mean no. If the user taps “Deny” twice for the same permission, the dialog stops appearing. adb shell dumpsys package <package> shows it as USER_FIXED.
• “Files & Media”. The Storage permission group is renamed. An app using scoped storage that asks for READ_EXTERNAL_STORAGE gets a dialog about photos and media.

For apps that target API 30:

• Auto-reset. If the user does not open the app for a few months, Android resets its runtime permissions and tells the user. The per-app switch is “Remove permissions if app isn’t used” in App info > Permissions.
• Background location. A request for foreground and background location at once is ignored. The app asks for foreground location first, then for ACCESS_BACKGROUND_LOCATION, and the user turns on “Allow all the time” in Settings.
• Phone numbers. getLine1Number() needs READ_PHONE_NUMBERS instead of READ_PHONE_STATE.
• New. MANAGE_EXTERNAL_STORAGE (“All files access”) and QUERY_ALL_PACKAGES, both covered below.

The system owns both dashed steps. The dialog for background location has no button to grant it; the user must pick “Allow all the time” on the settings page.

The overlay permission also changed. ACTION_MANAGE_OVERLAY_PERMISSION always opens the top-level settings list and ignores the package in the intent. Call screening apps and apps capturing the screen get SYSTEM_ALERT_WINDOW on request.

What changed for your app

All apps on Android 11

Apps targeting API 30

Scoped storage itself arrived in Android 10, where an app could still opt out. From API 30 there is no opt-out, but Android 11 brought back direct file paths (File, fopen()) for media an app can already reach, and added batch edits for media files.

Apps whose core job needs every file, such as file managers, antivirus and backup apps, can declare MANAGE_EXTERNAL_STORAGE. The user enables “Allow access to manage all files” on a settings page the app opens with ACTION_MANAGE_ALL_FILES_ACCESS_PERMISSION, and isExternalStorageManager() reports the result. Even then, other apps’ folders under Android/data stay closed.

Package visibility works the same way. An app that talks to a text-to-speech engine or a speech recognition service, for example, must declare that intent in <queries>. For the rare app that needs the full list, QUERY_ALL_PACKAGES exists. Google Play reviews both permissions: All files access from May 2021, and QUERY_ALL_PACKAGES through its Permissions Declaration Form.

What lasted

• Auto-reset grew into hibernation. From Android 12, an unused app also loses its jobs, push messages and cache. From December 2021 Google Play services brought the permission reset to Android 6.0 to 10.
• Package visibility and <queries> are still the rule, and Play still limits QUERY_ALL_PACKAGES to apps whose core function needs it.
• Storage kept narrowing. Android 13 replaced READ_EXTERNAL_STORAGE with READ_MEDIA_IMAGES, READ_MEDIA_VIDEO and READ_MEDIA_AUDIO.
• Foreground service types, required here for camera and microphone, became mandatory for every foreground service in apps targeting Android 14.
• Wireless debugging stayed. Android 17 with adb 37.0.0 added “adb Wi-Fi 2.0”, which reconnects on its own on a trusted network.
• One-time permissions and the two-denial rule are unchanged.

Worth knowing

• The Easter egg is a volume dial with 11 steps that stops at 10. Turn it to the top three times and it unlocks: it then reaches 11 and the next stage starts. The code says so: “until the dial is “unlocked”, you can’t turn it all the way to 11”.
• The next stage is Cat Controls, the Android 7.0 cat collector moved into the new device controls: a water bowl that fills from 0 to 200 mL, a food bowl, and a toy to throw.
• Google’s own launch post was titled “Turning it up to 11”, and its consumer post listed 11 new things.
• The R constant in AOSP has a one-word comment, R., right below a three-line quotation on Android 10’s Q.