[null,null,["最后更新时间 (UTC)：2025-07-26。"],[],[],null,["# Local Network Permission\n\nDevices on a LAN can be accessed by any app that has the `INTERNET`\npermission.\nThis makes it easy for apps to connect to local devices, but also carries\nprivacy implications such as forming a fingerprint of the user and being a\nproxy for location.\n\nThe Local Network Protections project aims to protect the user's privacy by\ngating access to the local network behind a new runtime permission.\n\nImpact\n------\n\nDuring Android 16, this permission is an opt-in feature which means only the\napps that opt-in will be affected. The goal of the opt-in is for app developers\nto understand which parts of their app depend on implicit local network access\nsuch that they can prepare to permission guard them on a future Android release.\n\nApps will be affected if they access the user's local network using:\n\n- Direct or library use of raw sockets on local network addresses (e.g. mDNS or SSDP service discovery protocol)\n- Use of framework level classes that access the local network (e.g. NsdManager)\n\n### Details of Impact\n\nTraffic to and from a local network address requires local network access\npermission. The following table lists some common cases:\n\n| App Low Level Network Operation | Local Network Permission Required |\n|--------------------------------------------------------|-----------------------------------|\n| Making an outgoing TCP connection | yes |\n| Accepting an incoming TCP connection | yes |\n| Sending a UDP unicast, multicast, broadcast | yes |\n| Receiving a incoming UDP unicast, multicast, broadcast | yes |\n\nThese restrictions are implemented deep in the networking stack, and thus they\napply to **all networking APIs**. This includes sockets created in the platform\nor managed code, networking libraries like Cronet and OkHttp, and any APIs\nimplemented on top of those. Trying to resolve services on the local network\n(i.e. those with a .local suffix) will require local network permission.\n| **Note:** Traffic originating from Android Webviews that require local network access will inherit permission state from the host app\n\nExceptions to the preceding rules:\n\n- If a device's DNS server is on a local network, traffic to / from it (at port 53) doesn't require local network access permission.\n- Applications using Output Switcher as their in-app picker won't need local network permissions (more guidance to come at a later release).\n\n| **Note:** Many media casting scenarios depend on access to the local network and will be impacted by this change. However, not all apps which offer casting will need to request the new permission. Future APIs and guidance for dealing with casting scenarios will be provided at a later Android Release.\n\nGuidance\n--------\n\nTo opt into local network restrictions, do the following:\n\n1. Flash your device to a build with Android 16 Beta 3 or later\n2. Install the app to be tested\n3. Toggle the Appcompat config by using adb\n\n adb shell am compat enable RESTRICT_LOCAL_NETWORK \u003cpackage_name\u003e\n\n4. **Reboot the device**\n\nNow your app's access to the local network is restricted and any attempt to\naccess the local network will lead to socket errors.\nIf you are using APIs that perform local network operations outside of your app\nprocess (Ex: NsdManager), they won't be impacted during the opt-in.\n\nTo restore access, you must grant your app permission to `NEARBY_WIFI_DEVICES`.\n\n- Ensure the app declares the `NEARBY_WIFI_DEVICES` permission in its manifest.\n- Go to Settings \\\u003e Apps \\\u003e \\[Application Name\\] \\\u003e Permissions \\\u003e Nearby devices \\\u003e Allow\n\n| **Note:** in a future Android release, this feature will be guarded by a new permission in the [`NEARBY_DEVICES`](/reference/android/Manifest.permission_group#NEARBY_DEVICES) permission group.\n\nNow your app's access to the local network should be restored and all your\nscenarios should work as they did prior to opting the app in. Here is how the\napp network traffic will be impacted.\n\n| Permission | Outbound LAN Request | Outbound/Inbound Internet Request | Inbound LAN Request |\n|-------------|----------------------|-----------------------------------|---------------------|\n| Granted | Works | Works | Works |\n| Not Granted | Fails | Works | Fails |\n\nUse the following command to toggle-off the Appcompat config \n\n adb shell am compat disable RESTRICT_LOCAL_NETWORK \u003cpackage_name\u003e\n\n### Errors\n\nErrors arising from these restrictions will be returned to the calling socket\nwhenever it invokes `send` or a `send` variant to a local network address.\n\nExample errors: \n\n sendto failed: EPERM (Operation not permitted)\n\n sendto failed: ECONNABORTED (Operation not permitted)\n\n### Bugs\n\n[Submit bugs](/about/versions/16/feedback) and feedback for:\n\n- Discrepancies in LAN access (you don't think a certain access should be considered \"local network\" access)\n- Bugs where LAN access should be blocked but isn't\n- Bugs where LAN access shouldn't be blocked but is\n\nThe following should be unaffected by this change:\n\n- Access to the Internet\n- Mobile Network"]]
