Android 7.0 Nougat: two apps on one screen

Android 7.0 Nougat is the release that put two apps on one phone screen. Users got split-screen multi-window, replies typed straight into a notification, and Doze that also works while the phone moves in a pocket. Developers got file-based encryption with Direct Boot, a declarative network security config, and a crash for apps that still share file:// URIs.

At a glance

Google declared the N APIs final on 15 June 2016 and told developers they could publish updates that compile against, and optionally target, API 24. On 22 August Dave Burke announced the rollout “starting with Nexus devices”: over several weeks to the Nexus 6, 5X, 6P, 9, Nexus Player, Pixel C and General Mobile 4G (Android One). The source went to AOSP the same day, and Ars Technica published its review.

The first developer preview came out on 9 March 2016. Burke called it “early… really early”, and the new Android Beta Program delivered it over the air to the same Nexus devices and the Pixel C. Its five developer previews, from March to July, follow this overview as parts, from Developer Preview 1 to Developer Preview 5. At launch he also moved Nougat to “a new regular maintenance schedule over the coming quarters”. Phones built on Qualcomm’s Snapdragon 800 and 801, which powered most flagships from late 2013 to late 2014, were left out: Ars Technica found an official Nougat update for them “very difficult if not completely impossible”.

What it brought

• Multi-window. Two apps run side by side or one above the other on phones and tablets. Ars Technica describes the gesture: long-press the Recents button, then pick the second app. Android TV got picture-in-picture, and users can drag and drop content between the two apps.
• Notifications. Direct Reply puts a text field inside the notification. Bundled notifications group several alerts from one app. MessagingStyle lays out conversations. A long press on a notification opens its controls.
• Doze on the go. Doze, added in Android 6.0 Marshmallow, now works in two levels. The first applies whenever the screen is off and the phone is unplugged, even in a pocket.

• Profile-guided JIT/AOT. ART gained a JIT compiler that profiles the hot methods of each app. It compiles them ahead of time only when the device is idle and charging. Google says large apps that took minutes to optimize on 6.0 now install “in just a matter of seconds”.
• Vulkan. The low-overhead 3D API is in the NDK, on hardware that supports it. The CDD makes every device ship a libvulkan.so; one without Vulkan reports zero devices from vkEnumeratePhysicalDevices.
• Data Saver. A user switch that blocks background data on metered networks. Apps read it with ConnectivityManager.getRestrictBackgroundStatus() and watch for ACTION_RESTRICT_BACKGROUND_CHANGED.
• Quick Settings tile API. Apps add tiles through TileService and the Tile class. Users can rearrange the tiles.
• Display size. Users scale the whole interface, not only the text, down to a minimum width of sw320dp.
• OpenJDK and Java 8. The core java.* libraries now come from OpenJDK instead of Apache Harmony. AOSP’s libcore at android-7.0.0_r1 has an ojluni tree that 6.0.1 lacks. With the Jack toolchain, lambdas work back to Gingerbread; default and static interface methods and streams need API 24.
• Emoji. Nougat supports Unicode 9, 72 new emoji by Ars Technica’s count, and is the first version with skin tone modifiers. Apps check that a glyph exists with Paint.hasGlyph() before inserting it; keyboards should offer the skin tones.
• Smaller additions. Multi-locale settings with LocaleList, a subset of ICU4J under android.icu, number blocking (BlockedNumberContract), call screening (CallScreeningService), OpenGL ES 3.2, VR mode, the keyboard shortcuts helper, custom pointer icons, the Frame Metrics API, and Chrome as the WebView provider.

Security and privacy

• File-based encryption. Files are encrypted one by one instead of as a single block device, which isolates each user and profile better. The 7.0 CDD says devices “SHOULD” meet the encryption requirement with FBE.
• Direct Boot. Built on FBE. After a reboot the phone reaches the lock screen, and alarm clocks, messages and accessibility services marked android:directBootAware run before the user unlocks. They see only device-encrypted storage; credential-encrypted storage opens after unlock.
• Strict Verified Boot. Android 7.0 strictly enforces Verified Boot, so a compromised device does not boot. It also corrects accidental data corruption.
• Seamless updates. On select new devices, two copies of the system partitions (slots A and B) let an update install in the background. If the new slot fails to boot, the device falls back to the old one. Ars Technica notes it only works on devices that launch with 7.0 or later.
• Media stack split. After Stagefright, mediaserver was broken up. Parsing in libstagefright runs in a mediacodec sandbox with very few permissions. Camera access lives only in cameraserver, and Bluetooth only in audioserver. Integer overflow checks cover the whole media stack.
• Trusted CAs. Apps targeting API 24 trust only the system CA store. Certificates installed by the user or by a device admin are ignored unless the app opts in. Every compatible device ships the same AOSP CA set.
• Network security config. An XML file, referenced by android:networkSecurityConfig, sets trust anchors per domain, cleartext rules, certificate pins, and debug-only overrides.
• Smaller changes. APK Signature Scheme v2 signs the whole file and verifies faster. Key attestation proves a key lives in hardware. Seccomp became a CDD requirement, the kernel got read-only memory and restricted access to userspace, and library load order is randomized.

Permissions

No new dangerous permissions arrived. The changes are about files and scoped access.

• Added. BIND_QUICK_SETTINGS_TILE, BIND_SCREENING_SERVICE, BIND_VR_LISTENER_SERVICE and BIND_CONDITION_PROVIDER_SERVICE. They guard services that the system binds to.
• Removed. FLASHLIGHT left the SDK.
• Scoped directory access. StorageVolume.createAccessIntent() asks for one folder, such as Pictures, instead of all of READ_EXTERNAL_STORAGE. The user allows or denies it in a dialog.
• Private files. For apps targeting API 24, the private data directory is 0700. MODE_WORLD_READABLE and MODE_WORLD_WRITEABLE throw a SecurityException. See the next section for what to do.
• Blocked numbers. Only the default phone app, the default SMS app and carrier apps can read or write the blocked list.
• Method tracing. Debug.startMethodTracing() writes to the app’s own directory on shared storage, so it no longer needs WRITE_EXTERNAL_STORAGE.
• Backup. Android Backup now covers runtime permission grants, according to Google’s Nougat feature list.

What changed for your app

All apps on Android 7.0

Apps targeting API 24

What lasted

• Multi-window grew: Android 8.0 brought picture-in-picture to phones, and Android 10 keeps every visible activity resumed, where 7.0 resumed only the one last touched.
• Background limits tightened in Android 8.0. Apps targeting API 26 can no longer declare manifest receivers for most implicit broadcasts.
• Network security config is still the place for trust rules. From Android 9, apps that target API 28 block cleartext traffic by default.
• File-based encryption became mandatory for devices launching with Android 10. It could not be combined with adoptable storage on 7.0 to 8.1.
• A/B updates got streaming in Android 8.0, and Virtual A/B replaced the original layout in Android 10.
• Jack did not last either. In March 2017 Google deprecated it and moved Java 8 language support into the standard javac and dx tools.
• Scoped directory access did not last. createAccessIntent() was deprecated in API 29 and returns RESULT_CANCELED on Android 10.

Worth knowing

• The N constant in AOSP carries the comment N is for ¯\_(ツ)_/¯.
• Inside Google, N was “New York Cheesecake”, Android Police reported in March 2016. AOSP history at the 7.0 tag shows the initials in branch names such as nyc-dev and nyc-release.
• Google asked the public for names on android.com under #NameAndroidN, with entries closing on 8 June 2016. It was a call for suggestions, not a vote. Google kept the final choice and revealed Nougat on 30 June 2016.
• The Easter egg is Android Neko, a cat collector. Tap “Android version” in Settings three times quickly, tap the logo five times, then long-press it. A toast shows a cat: a hidden Quick Settings tile is now enabled.
• The tile fills a dish with Bits, Fish, Chicken or a Treat. A JobScheduler job then runs in 15, 30, 60 or 120 minutes, and a notification says “A cat is here.” Better food makes a new cat likelier than a returning one: 5% for Bits, 90% for a Treat.