LibCapsule: Complete Confinement of Third-Party Libraries in Android Applications

Android application (or app) developers increasingly integrate third-party libraries to enrich the functionality of their apps. However, current permission model on Android cannot constrain the behaviors of in-app third-party libraries for allowing them to operate with the same permissions as their host app. This brings serious security and privacy concerns to users. In this article, we propose
LibCapsule
, a user-level solution to confine third-party libraries from potential permission abuses. Compared to previous systems,
LibCapsule
is able to provide
complete
confinement of third-party libraries in Android apps, including the static Java code, dynamically loaded code and native code of third-party libraries. We have developed a prototype of
LibCapsule
, and collected 204 popular third-party libraries as well as 2,021 apps to evaluate it. The evaluation results indicate that
LibCapsule
is capable of enforcing complete and fine-grained regulation on third-party libraries according to customized security policies with a low performance overhead. To engage the whole community, we will release the dataset of third-party libraries and apps in our evaluation.