IssueTracker

This issue was originally reported for Android O developer preview at
https://issuetracker.google.com/issues/63125228

Since it has been neglected(neither Android 8.x and Android P DP1 have it fixed), I am raising it here again, specifically for the upcoming Android P.

To expedite resolution of your issue, please provide as much relevant and specific information as possible. This will probably require some work from you. Most reports should include at least the following:

    * Which Developer Preview build are you using? See Settings > About phone > Build number (for example OPP5.170921.005).
ppp1.180208.014

    * Is this a regression from O to P?
No, This issue has been existing since Android M

    * What device are you using? (for example, Pixel XL)
Pixel


    * What are the steps to reproduce the problem? (Please provide the minimal reproducible test case.)
1,Build an app with targetSDK less than 23, write code using WifiManager.getScanResults(), and don't announce any location permission in the manifest
2,Enable wifi on the device
3,Let the app call the getScanResults()

    * Issue Category e.g. Framework (platform), NDK (platform), Hardware (CPU, GPU, Sensor, Camera), ART (platform), Runtime Permissions etc
Framework

    * What was the expected result?
Apps with targetSDK < 23 are supposed to get an emptylist from WifiManager.getScanResults() if the app does not have (coarse) location permission.

    * Can you provide the API document where this expected behavior is explained?

Here is the copy from the original post:

Android 6 (API 23) started requiring the location permission for

https://developer.android.com/reference/android/net/wifi/WifiManager.html#getScanResults()

However, apps targeting pre-Android-6 API aren't checked for this permission at all and can still access this privacy-related information which indirectly reveals user's location. This way they can bypass the check forever - even in the latest Android O beta it is still possible to call WifiManager.getScanResults() without any permission check if the app defines target SDK 22 or less in its manifest.

This is wrong from the privacy point of view and should be forbidden in Android O. Malicious apps will just use target SDK 22 and will have access to users' location without any warning from Android. There are online databases mapping SSIDs to location (and Google itself uses this technique to get network-based location) and the protection right now is zero. Developers already had 2 years since the introduction of Android 6 to adapt their applications which should be more than enough. Moreover, it will take at least 1 year to get Android O to end users and before the check is finally enforced.

The code that checks for permissions of this call is in

com/android/server/wifi/util/WifiPermissionsUtil.java

In particular, in the check

// LocationAccess by App: For AppVersion older than minVersion,
// it is sufficient to check if the App is foreground.
// Otherwise, Location Mode must be enabled and caller must have
// Coarse Location permission to have access to location information.
boolean canAppPackageUseLocation = isLegacyForeground(pkgName, minVersion)
       || (isLocationModeEnabled(pkgName)
                && checkCallersLocationPermission(pkgName, uid));

isLegacyForeground () should be removed.

    * What was the actual result?
Valid WiFi scan results are available

    * Relevant logcat output.
not applicable

    * Why am I asking for this change request that may break legacy apps
Google play is enforcing target API requirement this autumn, and it should be synchronized to Android platform

releated announcement
https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html