Breaking changes for ACAP applications - Are you ready?

[maria-h-axis]

In upcoming AXIS OS releases, Axis will introduce additional security measures in AXIS OS and ACAP applications:

• From AXIS OS 11.8, released in January 2024, root-privileged access is disabled by default (but can be reenabled).
• From AXIS OS 12.0, planned for Q3 2024, the ability for root-privileged access will be entirely removed for ACAP applications.
• From AXIS OS 12.0, the default setting in AXIS OS will be to only allow signed ACAP applications. The system administrator can opt in to allow unsigned ACAP applications.

Recommended testing for ACAP applications

You can now test your ACAP application to verify if it will work without root-privileged access. Follow these steps:

1. Install AXIS OS 11.5 or higher on your device
2. If you already have the ACAP installed, uninstall it
3. Go to the application page and disable "Allow root-privileged apps"
4. Install your ACAP application
5. Start the application and verify that your use cases work as expected
6. Uninstall your ACAP application

If everything works, your ACAP application will not be affected by the root-related upcoming changes.

If you experience issues that you are not able to solve on your own, you can contact Axis at [email protected] to learn if there are alternative mechanisms to run your use case. Please include information on your use case, and what functionality that breaks in your ACAP application when you do not allow root privileges. Based on feedback, new solutions may be provided to resolve common use cases not previously possible without root-privileged access.

To further future-proof your ACAP application and for additional security, we recommend that you specify your ACAP application to run as a generated dynamic user in the manifest.json schema. This will not be mandatory for AXIS OS 12.0, but is planned to be at a later point.

You can read more about the upcoming changes on axis.com: Additional security in AXIS OS and ACAP applications