Android 9 Pie: idle apps lose camera and mic

Android 9 Pie is the release that cut idle apps off from the camera, the microphone and the sensors. Apps targeting API 28 lost cleartext HTTP by default, and calls into hidden platform APIs started to fail. Users got a pill-shaped home button with swipe navigation, Adaptive Battery, and the last dessert name Google used in public.

At a glance

The first developer preview came out on 7 March 2018; the five preview milestones are the parts below this overview. The beta followed on 8 May, during Google I/O, and thanks to Project Treble it also ran on phones from Essential, Nokia, Oppo, Sony, Vivo and Xiaomi.

On 6 August 2018 Google pushed the source to AOSP and started the over-the-air update to Pixel phones. 9to5Google reported the Pixel and Pixel 2 images live that day, with the August security patch. Essential started pushing the final release to the Essential Phone the same day. Google promised the update by the end of fall to devices in the beta from Sony, Xiaomi, HMD Global, Oppo, Vivo, OnePlus and Essential, and to qualifying Android One phones. AOSP lists the first Pie builds for Pixel 3 and Pixel 3 XL (PD1A) at the September 2018 patch level. AOSP security bulletins listed Android 9 for the last time in January 2022; from February 2022 they cover Android 10 and later.

What it brought

• New system navigation. A single pill-shaped home button: swipe up for a new Overview with full-screen app previews, tap to go home. It was off by default, under Settings > Gestures > “Swipe up on home button”. Back stayed a button, hidden on the home screen.
• Adaptive Battery. Built with DeepMind, it uses machine learning to give system resources to the apps the user cares about. Underneath are the App Standby Buckets, covered under What changed for your app.
• Display cutout support. DisplayCutout and getDisplayCutout() report where the notch is. The layoutInDisplayCutoutMode window attribute takes DEFAULT, SHORT_EDGES or NEVER. Developer options can simulate a cutout on any device. The 9 CDD allows cutouts only on the short edges, at most one per edge.
• Smaller user changes. A rotation button in the navigation bar when auto-rotate is off, a screenshot editor, a text magnifier while selecting, simplified volume controls, and Adaptive Brightness. The clock moved to the left of the status bar to leave room for a notch, and quick settings tiles lost their drop-down panels: a long press opens the setting instead, as Ars Technica noted.
• Notifications. MessagingStyle takes a Person, shows images with setData(), keeps reply drafts (EXTRA_REMOTE_INPUT_DRAFT) and offers smart replies through RemoteInput.setChoices(). Users can block whole channel groups.
• Multi-camera API. Apps can open streams from two or more physical cameras at once, or one logical camera that switches between them. External USB cameras work through Camera2 on supported devices.
• Media and images. ImageDecoder replaces BitmapFactory, and AnimatedImageDrawable plays GIF and WebP. HEIF encoding, HDR VP9 Profile 2 and a Dynamics Processing audio effect joined the platform.
• Wi-Fi RTT. On supported hardware, apps with ACCESS_FINE_LOCATION measure distance to IEEE 802.11mc access points without connecting. Three or more give a position typically within 1 to 2 meters.
• Machine learning and text. Neural Networks API 1.1 with nine new operations, Smart Linkify on top of TextClassifier, PrecomputedText, and Slices and App Actions to show app content in Google surfaces.
• ART and tracing. ART’s ahead-of-time compiler converts an app’s DEX files into a more compact form, so apps start faster and use less disk and RAM; low-end devices gain the most. System traces can be recorded on the device itself and shared as a report, HTML included.
• Digital Wellbeing. The Dashboard, App Timer, the new Do Not Disturb and Wind Down. It shipped as a Google app from the Play Store, in beta on Pixel phones running Android 9.

Security and privacy

• Idle apps lose input. While an app’s UID is idle, the microphone reports empty audio, SensorManager sensors stop sending events, and its cameras disconnect with an error. Use a foreground service to keep receiving sensor events.
• TLS by default. For apps targeting API 28, isCleartextTrafficPermitted() returns false unless the Network Security Configuration allows cleartext for a domain. The table for apps targeting API 28 says what to do.
• Private DNS. Android 9 upgrades DNS to DNS over TLS when the network’s server supports it. Users can turn it off or name a provider in “Private DNS” under Network & internet. Apps that resolve names themselves can check LinkProperties.isPrivateDnsActive().
• BiometricPrompt. The system draws one biometric dialog for fingerprint, face or iris. Apps should move from FingerprintManager to BiometricPrompt.
• StrongBox. A new Keystore backed by a separate secure chip with its own CPU, storage and true random number generator. Request it with setIsStrongBoxBacked(true); an unsupported key throws StrongBoxUnavailableException. The 9 CDD only strongly recommends it.
• Android Protected Confirmation. On supported devices that launch with Android 9, ConfirmationPrompt shows a statement the user approves outside the main OS. The Trusted Execution Environment then signs it.
• Keymaster 4. Secure key import, Triple DES for legacy systems, separate patch levels per partition, and setUnlockedDeviceRequired() for keys that cannot decrypt while the screen is locked.
• APK Signature Scheme v3. It can carry a proof-of-rotation record, so an app can move to a new signing key.
• Platform hardening. Control Flow Integrity in the media framework, NFC and Bluetooth, kernel CFI support, more integer overflow sanitizers, and a stricter seccomp filter. File-based encryption now works with adoptable storage, and metadata encryption arrived where hardware supports it.
• Lockdown. “Show lockdown option” in the lock screen settings adds a “Lockdown” button to the power menu. It turns off Smart Lock, fingerprint unlocking and notifications on the lock screen until the user unlocks with a PIN, pattern or password.
• Encrypted backups. With a PIN, pattern or password set, Android backups are encrypted with a client-side secret, and restoring them needs that screen lock.
• Smaller changes. A developer option for a randomized MAC address when connecting to Wi-Fi, WPS deprecated, Android secure encrypted files (ASEC) removed, and hostname checks no longer fall back to the certificate’s CN.

Permissions

• CALL_LOG group. READ_CALL_LOG, WRITE_CALL_LOG and PROCESS_OUTGOING_CALLS moved out of the PHONE group into a new CALL_LOG group. Request them on their own or get a SecurityException.
• Phone numbers. Numbers in the phone state broadcast and in PhoneStateListener come back empty without READ_CALL_LOG.
• Wi-Fi scans. WifiManager.startScan() needs ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION, CHANGE_WIFI_STATE, and location services on. Reading SSID and BSSID from getConnectionInfo() needs a location permission and ACCESS_WIFI_STATE.
• Cell info. With device location off, getAllCellInfo(), getCellLocation() and getNeighboringCellInfo() return nothing.
• Serial number. Build.getSerial() needs READ_PHONE_STATE.
• Added. FOREGROUND_SERVICE (normal), USE_BIOMETRIC (normal), ACCEPT_HANDOVER (dangerous) and NFC_TRANSACTION_EVENT (normal).
• Deprecated. USE_FINGERPRINT, in favour of USE_BIOMETRIC.

What changed for your app

All apps on Android 9

The bucket limits jobs, alarms and high-priority FCM messages, and in “rare” also network access. They apply only on battery, and the manufacturer decides how apps are assigned.

The Wi-Fi background limit used to apply to each app: on Android 8.0 and Android 8.1 Oreo, every background app could scan once in 30 minutes. On Android 9 that one scan is shared by all of them.

The old-app warning reads “This app was built for an older version of Android and may not work properly.” AOSP shows it when targetSdkVersion is below ro.build.version.min_supported_target_sdk, which Pie sets to 17.

Non-SDK interfaces fall into lists. The light greylist keeps working, with log entries and toasts to flag it. The dark greylist fails for apps targeting API 28, and the blacklist fails for every app, with errors such as NoSuchMethodError or NoSuchFieldException.

To test, adb shell settings put global hidden_api_policy_p_apps 1 (and hidden_api_policy_pre_p_apps for older targets) lifts the restriction.

Apps targeting API 28

What lasted

• Gesture navigation became full in Android 10: back from an edge swipe, home from the bottom, and the default on new devices, with three buttons still offered.
• Non-SDK restrictions grow every release. Interfaces still allowed in Pie but blocked in Android 10 sit on the max-target-p list.
• Background camera and microphone got stricter in Android 11: a foreground service needs the camera or microphone type, and one started from the background cannot use them.
• Device identifiers: Android 10 put Build.getSerial() and the IMEI behind READ_PRIVILEGED_PHONE_STATE, which Play apps cannot hold.
• BiometricPrompt reached older versions through the AndroidX Biometric library, which added BiometricManager.
• Dessert names ended here. Google dropped them with Android 10.

Worth knowing

• At launch the Easter egg was still just a “P”, as Ars Technica noted: a letter drawn over colour rings that change on every launch and resize with two fingers. Pixel 3 builds (android-9.0.0_r11) swapped it for a drawing app labelled PAINT.APK.
• In AOSP, Build.SERIAL is set by reading a property called no.such.thing. A comment explains why: a function call stops compilers from inlining the value, so the platform can return "unknown" to apps targeting API 28.
• Google’s own post joked about the name: “Slices (pie…slices…get it?!)”.
• When Google retired dessert names in August 2019, one reason it gave was that “pies are not a dessert in some places”.