Android 8.0 Oreo: limits on background work

Android 8.0 Oreo is the release that put background work on a leash. Apps targeting API 26 can no longer run services freely from the background or listen for most implicit broadcasts from their manifest, and every notification has to belong to a channel the user controls. Underneath, Project Treble split the Android framework from the vendor code, so a phone could be updated without the chip maker reworking it first.

At a glance

The first developer preview came out on 21 March 2017, for the Nexus 5X, Nexus 6P, Nexus Player, Pixel, Pixel XL and Pixel C; the four developer previews are the parts below this overview. Google froze the API on 8 June 2017 and opened Play to apps targeting API 26 the same day. On 21 August it pushed the source to AOSP, updated Android Beta devices and announced that Pixel, Nexus 5X, Nexus 6P, Pixel C and Nexus Player builds were in carrier testing. The first public AOSP tags for those devices carry August 2017 security patches.

The name came out the same day, during the solar eclipse, with Android-themed Oreo cookies made by Nabisco for the launch event.

What it brought

• Background limits. The defining change, covered in What changed for your app.
• Notification channels. Every notification belongs to a channel the app creates with NotificationChannel. The user sets sound, vibration and importance per channel; Settings calls them “categories”. Once a channel exists, the app can no longer change its behaviour, only its name and description.
• More notification controls. Notification dots on launcher icons, snoozing, setTimeoutAfter() for notifications that cancel themselves, setColorized() for ongoing tasks such as navigation or a call, and a roomier collapsed MessagingStyle.
• Picture-in-picture on phones. Until 8.0 it was an Android TV feature. An activity opts in with android:supportsPictureInPicture and enters with enterPictureInPictureMode(PictureInPictureParams). In PiP it is paused but still visible, so playback should stop in onStop(), not onPause().
• Autofill framework. Password managers get a system API to fill login and payment forms in any app. Standard input views work with it with no code; the user picks the service in Settings.
• Adaptive icons. An icon is two layers, foreground and background, each 108×108 dp. The device maker’s mask cuts the shape, and only the inner 66×66 dp is always visible.
• Fonts as resources. Fonts go in res/font/ and into layouts by name. Downloadable fonts let apps share a font from a provider instead of bundling it; the same mechanism delivers updated emoji. Support Library 26 brings both back to older versions.
• Smaller additions. Autosizing TextView, pinned shortcuts and widgets (requestPinShortcut()), wide-gamut colour per activity, Wi-Fi Aware, LDAC and Bluetooth 5 support, TextClassifier for smart text selection, java.time, java.nio.file and java.lang.invoke from OpenJDK, and per-app cache quotas (getCacheQuotaBytes()). WebView gains Safe Browsing, version, renderer termination and renderer importance APIs; an activity can move between displays, and the app can pick the display it launches on; companion device pairing customises the Bluetooth, BLE and Wi-Fi pairing dialog.
• Users saw a reorganised Settings app, a redesigned emoji set with more than 60 new emoji from Unicode 10 (the round faces replaced Google’s blob emoji), and boot times Google put at up to twice as fast on the Pixel.

Security and privacy

• Project Treble. A stable vendor interface now sits between the Android framework and the device-specific code written mostly by chip makers. It is validated by the Vendor Test Suite, as CTS validates the app API. Google said it would come to every new device launching with Android 8.0; Ars Technica reported it was optional for upgraded devices.
• Install unknown apps. The global “Unknown sources” switch is gone. The user now allows each installing app separately, under “Install unknown apps”. Google’s reason was the “hostile downloader”: an app that tricks the user into installing malware disguised as an update.
• Sandbox. A seccomp filter applies to every app, limiting system calls to those bionic exposes. WebView renders in a separate, isolated process by default. Treble moved many hardware components into tighter sandboxes.
• Kernel and userspace. Hardened usercopy, PAN emulation, read-only after init and KASLR in the kernel; control-flow integrity in the media stack. App overlays can no longer cover system-critical windows.
• Boot and keys. Android Verified Boot (AVB) arrived, with rollback protection in the boot loader code. Key attestation became required on every device shipping with 8.0, and the lock screen credential can be checked by tamper-resistant hardware.
• Identifiers. ANDROID_ID is now different for each app signing key, user and device. Build.SERIAL is deprecated in favour of Build.getSerial(), which needs READ_PHONE_STATE. net.hostname is empty and the DHCP client no longer sends a hostname.
• TLS. SSLv3 is gone, and HttpsURLConnection no longer falls back to an older TLS version when a server negotiates badly.
• Updates. Streaming A/B updates install even when a device is low on disk space. They work only on devices that use A/B partitions.

Permissions

• Added. ANSWER_PHONE_CALLS and READ_PHONE_NUMBERS, both dangerous and in the PHONE group; MANAGE_OWN_CALLS, a normal permission for VoIP apps that manage their own calls through a self-managed ConnectionService.
• Install unknown apps. REQUEST_INSTALL_PACKAGES existed before, but an app targeting API 26 must now declare it to send the user to the package installer. Its protection level is signature|appop: the user grants it per app in Settings, not through a runtime dialog. Send the user there with ACTION_MANAGE_UNKNOWN_APP_SOURCES and check with canRequestPackageInstalls().
• Group grants fixed. Before 8.0, granting one permission also granted every other permission of its group that the app declared. For apps targeting API 26, only the requested one is granted. A later request in the same group is still approved without a dialog.
• Accounts. GET_ACCOUNTS alone no longer reveals the user’s accounts to apps targeting API 26. Use AccountManager.newChooseAccountIntent() or the authenticator’s own method.
• Alert windows. SYSTEM_ALERT_WINDOW apps targeting API 26 must draw with TYPE_APPLICATION_OVERLAY. Those windows stay under the status bar and keyboard, and the user can block them from the notification shade.

What changed for your app

All apps on Android 8.0

Apps targeting API 26

Manifest receivers still get broadcasts sent only to the app itself (such as ACTION_MY_PACKAGE_REPLACED), broadcasts that need a signature permission, and a published list of exempt implicit broadcasts. The permission changes for apps targeting API 26 (installs, accounts, alert windows, group grants) are in Permissions.

What lasted

• Background limits kept tightening. Android 9 added the FOREGROUND_SERVICE permission, and apps targeting Android 12 can no longer start foreground services from the background except in a few cases.
• Notification channels are still required. Android 13 added the POST_NOTIFICATIONS runtime permission on top of them.
• Adaptive icons are the icon format today. Android 13 added a monochrome layer for themed icons.
• Treble paid off in Android 9: devices launching with 9 or later can run a generic system image (adb shell getprop ro.treble.enabled tells you). The HIDL interfaces of that era are now deprecated in favour of AIDL for hardware abstraction layers.
• Serial and IMEI went further in Android 10: Build.getSerial() needs READ_PRIVILEGED_PHONE_STATE, which Play apps cannot hold.
• Install unknown apps is still granted per app.
• Play’s target-API rule started with this release: API 26 for new apps in August 2018 and updates in November 2018. From 2019 the floor rises each year, within a year of each Android release.

Worth knowing

• The Easter egg is an octopus. Tap “Android version” in “About phone”, long-press the “O” that appears, and one floats on screen. AOSP calls the activity Ocquarium, and the legs wobble on SpringAnimation from the support library’s physics package.
• Android 8.0 build IDs start with OPR (the first AOSP tag, for the Pixel C, is build OPR6.170623.010), and that string appears in the user agent. Google warned that browser detection matching /OPR/ can mistake any browser for Opera.
• The 8.0 CDD requires each attestation key to be shared by enough devices that it cannot identify one. Its suggested way: one key for every 100,000 units of a model.
• In AOSP Build.java, SERIAL is initialised through a function call on purpose, “to prevent its value being inlined in the app during compilation”, because the system sets it according to the app’s target SDK.
• A boot loop now triggers “Rescue Party”. When system_server restarts five times in five minutes, or a persistent system app crashes five times in 30 seconds, the system resets settings in three escalating steps. The fourth boots into recovery and offers a factory reset. In 8.0, a userdebug build connected over USB skips it.