The Third Beta of Android 17 (new VPN feature)

General
1

VPN app exclusion settings
By using the new ACTION_VPN_APP_EXCLUSION_SETTINGS Intent, your app can launch a system-managed Settings screen where users can select applications to bypass the VPN tunnel.

val intent = Intent(Settings.ACTION_VPN_APP_EXCLUSION_SETTINGS)
if (intent.resolveActivity(packageManager) != null) {
    startActivity(intent)
}

Wondering whether this mean selecting the ‘Block connections without VPN’ option will finally work with split-tunneling.

Other security/privacy feature (that weren’t unveiled before)

Enforced read-only dynamic code loading:

To improve security against code injection attacks, Android now enforces that dynamically loaded native libraries must be read-only. If your app targets Android 17 or higher, all native files loaded using System.load() must be marked as read-only beforehand.

There are also quite a lot of features to improve the Desktop experience as Google looks to unveil Aluminum OS, a Desktop OS based on Android. Those include widget support for external displays and better picture-in-picture, who now works for full apps.

1 Like
2

Android enforced split-tunnel always has worked regardless of Android’s VPN Lockdown mode (“Block connections without VPN”).

Just that, previously, the 3p apps that can do so had to be explicitly “whitelisted” / allowlisted in code at build time by the OEM.[1] This is besides the fact that the OS itself, including System (1p & 2p) apps, those preinstalled by OEM / Vendor / Google, could always bypass VPN Lockdown mode: Show Android components that can bypass VPN even in lockdown mode · Issue #224 · celzero/rethink-app · GitHub

  1. https://cs.android.com/android/platform/superproject/+/android-11.0.0_r3:frameworks/base/core/java/android/provider/Settings.java;l=6283-6291 ↩︎

2 Likes
3

So this means user can now add apps to this internal restricted list ?

I guess some apps you are refering to is for example the hotspot detection app ?

1 Like
4

Seems like. Will have to look at the code/implementation to be sure.

Not sure if the "hotspot detection app " (or apps pre-installed by the Carriers / MNOs / MVNOs) are 3p apps (ie, not part of Android’s “System” partition), but if so, then yes… those kind of apps.

5

Portal Captive app