Controlling Interactions with Libraries in Android Apps Through Runtime Enforcement

Abstract

Android applications are executed on smartphones equipped with a variety of resources that must be properly accessed and controlled, otherwise the correctness of the executions and the stability of the entire environment might be negatively affected. For example, apps must properly acquire, use, and release microphones, cameras, and other multimedia devices otherwise the behaviour of the apps that use the same resources might be compromised.Unfortunately, several apps do not use resources correctly, for instance due to faults and inaccurate design decisions. By interacting with these apps users may experience unexpected behaviours, which in turn may cause instability and sporadic failures, especially when resources are accessed.In this paper, we present an approach that lets users protect their environment from the apps that use resources improperly by enforcing the correct usage protocol. This is achieved by using software enforcers that can observe executions and change them when necessary. For instance, enforcers can detect that a resource has been acquired but not released, and automatically perform the release operation, thus giving the possibility to use that same resource to the other apps.The main idea is that software libraries, in particular the ones controlling access to resources, can be augmented with enforcers that can be activated and deactivated on demand by users to protect their environment from unwanted app behaviours. We call the software libraries augmented with one or more enforcers proactive libraries because the activation of the enforcer decorates the library with proactive behaviours that can guarantee the correctness of the execution despite the invocation of the operations implemented by the library. For example, enforcers can detect that a resource has not been released on time and proactively release it.Our experimental results with 27 possible misuses of resources in real Android apps reveal that proactive libraries are able to effectively correct library misuses with negligible runtime overheads. Controlling Interactions with Libraries in Android Apps Through Runtime Enforcement • :3to fix a detected problem). For example, when the onStop() callback is generated, the enforcer associated with the library for audio recording is triggered to check if the microphone has been released. If not, the enforcer may force the release of the microphone, and automatically reassign it to the activity once the activity becomes visible to the user again.Since a regular library does not need to be modified to be turned into a proactive library, enforcers can be easily added to existing libraries, without the need of designing libraries as proactive libraries from the very beginning. This eases the incremental adoption of the technology. Moreover, any party may contribute to the definition of the enforcers for a given library and not only the developers of the library. This aspect may facilitate the proliferation of the enforcers. App developers can keep using the usual testing and analysis methods ...

Proactive Libraries: Enforcing Correct Behaviors in Android Apps

“…This section summarizes the main results we obtained with Proactive Libraries. Additional details are available in [26].…”

“…To prevent users from experiencing annoying problems caused by apps that inaccurately interact with APIs, we introduced a novel concept of library, called Proactive Library [25,26], that forces the apps to behave as the APIs require. For example, Proactive Library forces the app to release the camera every time its execution is suspended, that is, every time the onPause() callback of the activity that acquires the camera is invoked.…”

Test4Enforcers: Test Case Generation for Software Enforcers

“…An overview of techniques to prevent failures by enforcing the correct behaviour at runtime has been recently published by Falcone et al [15]. Among these many domains, in this paper we focus on the Android environment, which has been already considered in the work by Falcone et al [12], who studied how to enforce privacy policies by detecting and disabling suspicious method calls, and more recently by Riganelli et al [35,36,34], who studied how to augment classic Android libraries with proactive mechanisms able to automatically suppress and insert API calls to enforce resource usage policies.…”

“…To prevent undesired behaviors that may result in software failures and crashes, runtime enforcement techniques have been used to modify the runtime behavior of software systems, forcing the systems to satisfy a set of correctness policies [16,27]. So far, runtime enforcement has been already applied to multiple domains, including security [21], resource management [35,36], and mobile computing [12,43].…”

Non-functional Testing of Runtime Enforcers in Android

“…To prevent these problems, users of mobile applications can install and activate software enforcers [12,15,32,11,10] that guarantee that specific correctness policies are satisfied (e.g., the camera is always released after it has been acquired). These enforcers can be typically generated automatically from a modelbased representation of the processes involved in the policy that must be enforced.…”