App circumvents storage permission in Marshmallow - Security Discussion

I own a Sony Z3 compact with Marshmallow 6.0.1 on it.
There is an pre-installed App called File Commander, which is an app to browse the contents of internal and sd card storage.
I have revoked all runtime permission from it in Android settings dialog.
Still, in this app I can explore all contents on my sd-card, delete files and view pictures.
Just to make sure that this App does not simply view this picture in another app put up front, I revoked storage permission from all apps (yes, also system apps). It would not make a difference.
How is that possible? It seems that Androids permission framework (on storage, at least) is easily exploitable.

Related

[I9505G] MicroSD app compatibility

UPDATE: Google's API changes to KitKat means the following, as per Google:
An application may request broad read-oonly permissions for external storage. This means that the application will be able to read the MicroSD only.
Applications cannot obtain permission to write to external storage. This means that file managers cannot edit/create/delete files on MicroSD anymore. This is a casualty of a change meant for security.
With or without requested permission for external storage, an application may now modify conents of its assigned folder on external storage (IE, /android/data). This allows an application to offload content to external storage if the storage is considered "permanent," Ie, MicroSD is considered permanent while OTG is not.
The benefits to this change means that applications required less tweaking to offload their data to external storage. We saw this with the recent Google Music update (and I'm loving that). Even now, it seems updates to recent Google applications are preparing to utilize this functionality. Google's camera.apk has taken up residence on my MicroSD so I suspect that a future update will allow you to store to external storage.
The downsides are that file managers cannot make use of MicroSD anymore, aside from reading the contents. Consider it collateral damage.
-reserved-
Titanium backup. Requires external SD permissions.xml fix to be able to store there.
Sent from my GT-I9505G using Tapatalk
ES doesn't work. If you delete a folder, it will show as deleted. Exit and come back, and the folder remains. Cannot edit or create a folder (in MicroSD).
Bump. OP now has full explanation of what's going on.
jaykresge said:
UPDATE: Google's API changes to KitKat means the following, as per Google:
An application may request broad read-oonly permissions for external storage. This means that the application will be able to read the MicroSD only.
Applications cannot obtain permission to write to external storage. This means that file managers cannot edit/create/delete files on MicroSD anymore. This is a casualty of a change meant for security.
With or without requested permission for external storage, an application may now modify conents of its assigned folder on external storage (IE, /android/data). This allows an application to offload content to external storage if the storage is considered "permanent," Ie, MicroSD is considered permanent while OTG is not.
The benefits to this change means that applications required less tweaking to offload their data to external storage. We saw this with the recent Google Music update (and I'm loving that). Even now, it seems updates to recent Google applications are preparing to utilize this functionality. Google's camera.apk has taken up residence on my MicroSD so I suspect that a future update will allow you to store to external storage.
The downsides are that file managers cannot make use of MicroSD anymore, aside from reading the contents. Consider it collateral damage.
Click to expand...
Click to collapse
Reading from Android Developer new API changes tha way you read and write from External Sd card... but if your app has WRITE_EXTERNAL_STORAGE permission it should be able to write your ext sd card without problems.
This means that current apps (and File Managers) should be updated to support kitkat API level 9 and obtain WRITE_EXTERNAL_STORAGE permission.
public static final String WRITE_EXTERNAL_STORAGE
Added in API level 4
Allows an application to write to external storage.
Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don't need this permission, be sure your targetSdkVersion is 4 or higher.
Starting in API level 19, this permission is not required to read/write files in your application-specific directories returned by getExternalFilesDir(String) and getExternalCacheDir().
Constant Value: "android.permission.WRITE_EXTERNAL_STORAGE"
API level 19 is kitkat code....

Sd card Q&A

Never owned a phone that came with microsd and this new Sony phone intrigues me. Biggest bummer about this phone is that it only comes with 16 GB internal storage. I don't know how this work since the kit-kat upgrade came out but my question is that say I'm a heavy Whatsapp user and and have lots of photos and convos saved onto my phone so can that automatically transfer to my sdcard? With this little memory im scared I might run out of room with all my other apps as well. Btw i'm not a guy that roots my phone so that would be out of the question unless that was the only last option to make this work. Hope to get some detailed feedback from you guys. :fingers-crossed::laugh:
I don't think you would need to root the Z3 to do what you want. I haven't had an expandable memory slot since my old HD2. Nexus 4 for the last few years, working with limited memory is something I wish to finally again leave behind.
I don't know how it works on the Z3, but with KitKat this is the gist:
Apps can write to the sdcard, but only to their "approved" folders. E.g. After 4.3 or so we got an /Android/data/ folder inside the root of our sdcards. Inside that are app package names. So if a developer calls getExternalFilesDirs() it will list an array, one being the internal Android/data folder and the other being the SDcard Android/data folder. However, no change is needed on the app developer if they let you browse directories (you can just point the save location to the proper data folder package name). So, for example, I use FX File Explorer and move files to /extSdCard/Android/data/nextapp.fx/files from my internal memory on my S4.
Currently the only negative are games like Baldur's Gate. They only install to the internal memory and at 2.3GB can not be moved to the sdcard. If you root you might be able to swap the directories, but I haven't tried as I prefer to not root. But as it stands, that 2.3GB would go against the 16GB internal storage.
jonshipman said:
I don't know how it works on the Z3, but with KitKat this is the gist:
Apps can write to the sdcard, but only to their "approved" folders. E.g. After 4.3 or so we got an /Android/data/ folder inside the root of our sdcards. Inside that are app package names. So if a developer calls getExternalFilesDirs() it will list an array, one being the internal Android/data folder and the other being the SDcard Android/data folder. However, no change is needed on the app developer if they let you browse directories (you can just point the save location to the proper data folder package name). So, for example, I use FX File Explorer and move files to /extSdCard/Android/data/nextapp.fx/files from my internal memory on my S4.
Currently the only negative are games like Baldur's Gate. They only install to the internal memory and at 2.3GB can not be moved to the sdcard. If you root you might be able to swap the directories, but I haven't tried as I prefer to not root. But as it stands, that 2.3GB would go against the 16GB internal storage.
Click to expand...
Click to collapse
Yea Iike the what's app itself is only cpl MB and I don't mind that on my internal but within what's app I have 3GB worth of photos videos from my group chats that I like to keep so I need to know if that can automatically be saved to sdcard or I have to find a different phone.
ms54 said:
Yea Iike the what's app itself is only cpl MB and I don't mind that on my internal but within what's app I have 3GB worth of photos videos from my group chats that I like to keep so I need to know if that can automatically be saved to sdcard or I have to find a different phone.
Click to expand...
Click to collapse
Where is WhatsApp saving the pictures? To tell you the truth, no phone post 4.4.4 without rooting will do what you need. So you may need to look for something with larger internal storage.

5-GB thumbnails removed, but the space has not been freed! Why?

I have a Sony Z3 dual sim version (D6633) running KitKat (4.4.4). I am posting here because I understand this issue is not Z3-specific and can affect most phones. In fact, it also affects Lollipop.
The CCleaner app revealed I had > 5 GBs in thumbnail files. I used the same app to delete them. The folder DCIM\.thumbnails became empty, but the available space hasn't changed. If I go to settings -> storage, Android tells me I have 2.50GB available (same as before deleting the files) and 7.32 GB in apps. There's no way I have 7.32GB of apps! If I use the storage analyzer app (https://play.google.com/store/apps/details?id=com.rjhartsoftware.storageanalyzer&hl=en) it tells me I have 5.57GBs "used by android/inaccesible files". In other words, it seems that removing the 5GBs of thumbnails has not saved any space!
This app (https://play.google.com/store/apps/details?id=com.mobile_infographics_tools.mydrive&hl=en) shows I have 9.07GBs occupied, but when I break it down by categories or file type, the total is nowhere near 9 GBs!
I tried all the suggestions listed at: https://code.google.com/p/android/i...c=ID Type Status Owner Summary Stars&id=39546
including #152 and #153:
I got Android to recreate the files by taking videos and photos with the camera, then replacing the .thumbnails files created with small files (I created small text files and renamed them with the same name).
I filled almost the entire remaining space with video file in the hope that the issue was caused by sparse files and Android would reclaim the space. It didn't.
I deleted the data from the media storage app
I wiped the dalvik cache and the cache rebooting in recovery mode
Having 5GB, out of the 11.5 available, vanish for no reason is a really unacceptable bug! Makes me wish I had an iphone
Has anyone found any solution?
Thanks!
Update huawei g700-u10
Hi,
Anyone know how to install or update huawei g700-u10 from jellybean 4.2.1 to kitkat or lollipop, Emotion UI version 1.6
Kernel version 3.4.5
Please put official website or real software link not surveys and other stupids thing only original website please
carlodl said:
I have a Sony Z3 dual sim version (D6633) running KitKat (4.4.4). I am posting here because I understand this issue is not Z3-specific and can affect most phones. In fact, it also affects Lollipop.
The CCleaner app revealed I had > 5 GBs in thumbnail files. I used the same app to delete them. The folder DCIM\.thumbnails became empty, but the available space hasn't changed. If I go to settings -> storage, Android tells me I have 2.50GB available (same as before deleting the files) and 7.32 GB in apps. There's no way I have 7.32GB of apps! If I use the storage analyzer app (https://play.google.com/store/apps/details?id=com.rjhartsoftware.storageanalyzer&hl=en) it tells me I have 5.57GBs "used by android/inaccesible files". In other words, it seems that removing the 5GBs of thumbnails has not saved any space!
This app (https://play.google.com/store/apps/details?id=com.mobile_infographics_tools.mydrive&hl=en) shows I have 9.07GBs occupied, but when I break it down by categories or file type, the total is nowhere near 9 GBs!
I tried all the suggestions listed at: https://code.google.com/p/android/i...c=ID Type Status Owner Summary Stars&id=39546
including #152 and #153:
I got Android to recreate the files by taking videos and photos with the camera, then replacing the .thumbnails files created with small files (I created small text files and renamed them with the same name).
I filled almost the entire remaining space with video file in the hope that the issue was caused by sparse files and Android would reclaim the space. It didn't.
I deleted the data from the media storage app
I wiped the dalvik cache and the cache rebooting in recovery mode
Having 5GB, out of the 11.5 available, vanish for no reason is a really unacceptable bug! Makes me wish I had an iphone
Has anyone found any solution?
Thanks!
Click to expand...
Click to collapse
You should have done factory reset.
If rooted take titanium backup of all apps you want to and then move that titanium folder to external storage or any safe place other than inyernal storage and then factory reset.
After reset install titanium and testore app+data of all apps you backuped
Sent from my LG-X160 using XDA Free mobile app
---------- Post added at 07:16 PM ---------- Previous post was at 07:16 PM ----------
carlodl said:
I have a Sony Z3 dual sim version (D6633) running KitKat (4.4.4). I am posting here because I understand this issue is not Z3-specific and can affect most phones. In fact, it also affects Lollipop.
The CCleaner app revealed I had > 5 GBs in thumbnail files. I used the same app to delete them. The folder DCIM\.thumbnails became empty, but the available space hasn't changed. If I go to settings -> storage, Android tells me I have 2.50GB available (same as before deleting the files) and 7.32 GB in apps. There's no way I have 7.32GB of apps! If I use the storage analyzer app (https://play.google.com/store/apps/details?id=com.rjhartsoftware.storageanalyzer&hl=en) it tells me I have 5.57GBs "used by android/inaccesible files". In other words, it seems that removing the 5GBs of thumbnails has not saved any space!
This app (https://play.google.com/store/apps/details?id=com.mobile_infographics_tools.mydrive&hl=en) shows I have 9.07GBs occupied, but when I break it down by categories or file type, the total is nowhere near 9 GBs!
I tried all the suggestions listed at: https://code.google.com/p/android/i...c=ID Type Status Owner Summary Stars&id=39546
including #152 and #153:
I got Android to recreate the files by taking videos and photos with the camera, then replacing the .thumbnails files created with small files (I created small text files and renamed them with the same name).
I filled almost the entire remaining space with video file in the hope that the issue was caused by sparse files and Android would reclaim the space. It didn't.
I deleted the data from the media storage app
I wiped the dalvik cache and the cache rebooting in recovery mode
Having 5GB, out of the 11.5 available, vanish for no reason is a really unacceptable bug! Makes me wish I had an iphone
Has anyone found any solution?
Thanks!
Click to expand...
Click to collapse
You should have done factory reset.
Before reset you can also save all images amd videos and files you want on any external source
If rooted take titanium backup of all apps you want to and then move that titanium folder to external storage or any safe place other than inyernal storage and then factory reset.
After reset install titanium and testore app+data of all apps you backuped
Sent from my LG-X160 using XDA Free mobile app

How to change SDCARD permissions to get rid of folder clutter.

On Android 7.0, all apps have access to /sdcard/Android/*
For apps to get sdcard access outside that Android folder, they need explicit permission.
I would like to remove the default allowed access to /sdcard/Android/* but keep the system in place that grants root SD access to allowed apps.
Bonus points, if I can somehow rid of DCIM, LOST.DIR, System Volume Information, and .android_secure from being created aswell.
The clutter is getting ridiculous. Simply swapping in an sdcard or plugging in a USB OTG drive will cause it to immedietly get cluttered.
This is external, swappable, storage we are dealing with FFS! Whose bright idea was this damn system.
I have root. (Is Xposed Privacy my only option?)
No I do not have adaptable storage enabled. This is simply regular external storage.

Encrypted portable microSD card in Settings; apps can't read it. Help?

Not sure if many of you are aware, but the U11 allows you to encrypt portable microSD cards in the settings, which is nice for privacy purposes. The problem is since I did that (I even rebooted after) many of my apps can't properly read or write to the microSD card. I've noticed many of said apps don't implement Google's expandable storage permissions properly either (i.e. they don't ask you to select the root directory of the microSD card in Android File Explorer so they have proper read-write access to everything.)
My questions, therefore, are:
What am I doing wrong? Is there some permission I'm missing?
Are 3rd party apps supposed to be able to work with encrypted portable storage?
Is encrypted portable storage even an AOSP feature? Or something specific to 3rd party OEMs?
Why do so many apps not implement microSD storage read/write permissions correctly?
Any ideas?

Categories

Resources