  The Android platform introduces the runtime permission model in version 6.0.
The new model greatly improves data privacy and user experience, but brings new
challenges for app developers. First, it allows users to freely revoke granted
permissions. Hence, developers cannot assume that the permissions granted to an
app would keep being granted. Instead, they should make their apps carefully
check the permission status before invoking dangerous APIs. Second, the
permission specification keeps evolving, bringing new types of compatibility
issues into the ecosystem. To understand the impact of the challenges, we
conducted an empirical study on 13,352 popular Google Play apps. We found that
86.0% apps used dangerous APIs asynchronously after permission management and
61.2% apps used evolving dangerous APIs. If an app does not properly handle
permission revocations or platform differences, unexpected runtime issues may
happen and even cause app crashes. We call such Android Runtime Permission
issues as ARP bugs. Unfortunately, existing runtime permission issue detection
tools cannot effectively deal with the ARP bugs induced by asynchronous
permission management and permission specification evolution. To fill the gap,
we designed a static analyzer, Aper, that performs reaching definition and
dominator analysis on Android apps to detect the two types of ARP bugs. To
compare Aper with existing tools, we built a benchmark, ARPfix, from 60 real
ARP bugs. Our experiment results show that Aper significantly outperforms two
academic tools, ARPDroid and RevDroid, and an industrial tool, Lint, on ARPfix,
with an average improvement of 46.3% on F1-score. In addition, Aper
successfully found 34 ARP bugs in 214 opensource Android apps, most of which
can result in abnormal app behaviors (such as app crashes) according to our
manual validation.
