Storage leak

[unclefab]

Some apps manage to access the internal/external storage storage even if it's blocked.
For example I block media and keep external storage unblocked, the app can access media (and vice versa).
I block get external storage state, the app still can access it.
I tried with rom tool box, kingsoft office, mantano reader, gone mad player...

[cobaltdr]

QR Droid is a case in point. Prevented all access, but the app happily accesses the camera.

[M66B]

Did you restart the application?

[M66B]

Please note: the back menu often doesn't stop the application.

[unclefab]

Of course I killed the apps:-)

[M66B]

Which Android version are you using?

http://www.androidcentral.com/jelly-bean-brings-new-permission-along-read-external-storage

[M66B]

@cobaltdr: this issue is about something else, so create a new issue.

[M66B]

I cannot reproduce this.
Do you mean read or write access?

[unclefab]

I'm on jb 4.1.2, and I know about this new perm, I've blocked it from day one with permissions denied.
Back to xprivacy, it's read and write.
You say that you can't reproduce it, which means that if you block let's say sd card and not media you can access media but not sd?
Strange, on my phone I still can access both.
Just now I made some tests with Dr web anti virus.
I blocked the three storage related perms, and I can't access neither the external storage nor some of the internal storage, but I still can access all the /system folder.
I blocked get external storage and media but kept sdcard unchecked, I can access both external and internal storage.
I blocked get external storage and sd card but kept media unchecked, I can't access neither external not internal storage, except the/system folder.
If you want I can describe what happens with other apps, but it's more or less the same story, they can access storage they are not supposed to.

[M66B]

1. Internal storage will never be restricted (external storage and media storage are different storages)
2. getExternalStorageState (please be concise) fakes the external storage to be offline, but an app can ignore that.

"I blocked the three storage related perms, and I can't access neither the external storage nor some of the internal storage, but I still can access all the /system folder." Correct, see first remark.

"I blocked get external storage and media but kept sdcard unchecked, I can access both external and internal storage." Correct, sdcard unchecked: external storage not restricted, internal storage: see first remark.

"I blocked get external storage and sd card but kept media unchecked, I can't access neither external not internal storage, except the/system folder." Correct, see first remark: internal storage is not the same as media storage.

I cannot change this, since this is how Android works.

[unclefab]

Ok, I will try to be more concise:-)
My understanding, and correct me if I'm wrong, is that:
we have external storage (ext sd card, it can be restricted),
media (music, pics, videos etc, located in the /data/media folder. It's sometimes called internal sd and although it's actually part of the internal storage it can be restricted),
internal storage (/data, /dev, /efs, /system and so on folders, it can't be restricted).
Now I test with ghost commander (a file manager).
I block getExternalStorageState, media and sdcard, I can access my internal storage only, correct.
I block getExternalStorageState and sdcard but keep media unrestricted, I can't access external sd but I can access media, correct.
I block getExternalStorageState and media but keep sdcard unrestricted, I can access both my media and my external sd card (actually I can access everything on the phone, as if nothing had been restricted), not correct.
I block media and sdcard but keep getExternalStorageState unrestricted, I can access everything on the phone including media (same as above), not correct.
Have I been concise enough?:-)

[M66B]

Could you please try if this version fixes your problem?
http://www.faircode.eu/xprivacy/XPrivacy_1.2.1.apk

If not, please repeat your tests and make a logcat like this:

adb logcat | grep XPackageManagerService

and tell me which output you get when.

[unclefab]

It still doesn't work. For now I'm busy and I can't get a logcat from my phone's terminal emulator but I will send one later when I connect to my laptop.

[unclefab]

Ok, here it is, hopefully it's what you need (actually the whole version is much longer, I put here what seemed relevant to me, in case you want the full logcat just ask and I'll put it here):

[deleted]

[M66B]

Please make the logcat as described earlier.
Run each of your tests and make sure you kill the application before running each test.
Use this command to extract the relevant log and tell me which test resulted in which log lines.

adb logcat | grep XPackageManagerService

[unclefab]

I made a full logcat, but the command to extract doesn't work, I tried many times and everytime I get a message "grep is not recognized as an internal or external command, operable program or batch file".

[M66B]

You are probably on Windows.
Solution:

adb shell logcat | grep XPackageManagerService

[unclefab]

Allright, so:
1- getExternalStorageState and sdcard are restricted, media is not. I open ghost commander, I get this:

I/XPrivacy/XPackageManagerService( 452): gid=1015 restriction=storage action=sd
card uid=10088
I/XPrivacy/XPackageManagerService( 452): Deny sdcard_r/sdcard_rw uid=10088
I/XPrivacy/XPackageManagerService( 452): gid=1023 restriction=storage action=sd
card uid=10088
I/XPrivacy/XPackageManagerService( 452): gid=1028 restriction=storage action=sd
card uid=10088
I/XPrivacy/XPackageManagerService( 452): Deny sdcard_r/sdcard_rw uid=10088
I/XPrivacy/XPackageManagerService( 452): get 10088/media storage=false # 261 ms

I/XPrivacy/XPackageManagerService( 452): get 10088/inet internet=true # 261 ms
I/XPrivacy/XPackageManagerService( 452): gid=1023 restriction=internet action=i
net uid=10088

I can access neither media nor sdcard.

2- getExternalStorageState and media are restricted, sdcard is not. I open ghost commander I get this:

I/XPrivacy/XPackageManagerService( 452): get 10088/sdcard storage=false # 262 m
s
I/XPrivacy/XPackageManagerService( 452): get 10088/media storage=true # 260 ms
I/XPrivacy/XPackageManagerService( 452): gid=1015 restriction=storage action=me
dia uid=10088
I/XPrivacy/XPackageManagerService( 452): gid=1023 restriction=storage action=me
dia uid=10088
I/XPrivacy/XPackageManagerService( 452): Deny media_rw uid=10088
I/XPrivacy/XPackageManagerService( 452): gid=1028 restriction=storage action=me
dia uid=10088
I/XPrivacy/XPackageManagerService( 452): get 10088/inet internet=true # 516 ms
I/XPrivacy/XPackageManagerService( 452): gid=1015 restriction=internet action=i
net uid=10088
I/XPrivacy/XPackageManagerService( 452): gid=1028 restriction=internet action=i
net uid=10088

I can access both media and sdcard, but sdcard is read only (media is read write).
Hope it helps...

[M66B]

Can you post the output of this:

adb shell mount

(delete the application specific lines for privacy)

[unclefab]

rootfs / rootfs ro,relatime 0 0 tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0 devpts /dev/pts devpts rw,relatime,mode=600 0 0 proc /proc proc rw,relatime 0 0 sysfs /sys sysfs rw,relatime 0 0 none /acct cgroup rw,relatime,cpuacct 0 0 tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0 tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0 none /dev/cpuctl cgroup rw,relatime,cpu 0 0 tmpfs /tmp tmpfs rw,relatime 0 0 /dev/block/mmcblk0p17 /efs ext4 rw,nosuid,nodev,noatime,user_xattr,acl,barrier=1,journal_async_commit,data=ordered 0 0 /dev/block/mmcblk0p19 /system ext4 ro,noatime,user_xattr,acl,barrier=1,data=ordered 0 0 /dev/block/mmcblk0p18 /cache ext4 rw,nosuid,nodev,noatime,errors=panic,user_xattr,acl,barrier=1,journal_async_commit,data=ordered 0 0 /dev/block/mmcblk0p21 /data ext4 rw,nosuid,nodev,noatime,errors=panic,user_xattr,acl,barrier=1,journal_async_commit,data=ordered,noauto_da_alloc,discard 0 0 /sys/kernel/debug /sys/kernel/debug debugfs rw,relatime 0 0 /dev/fuse /storage/sdcard0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0 /dev/block/vold/179:9 /storage/extSdCard vfat rw,dirsync,nosuid,nodev,noexec,noatime,nodiratime,uid=1000,gid=1023,fmask=0002,dmask=0002,allow_utime=0020,codepag e=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0

[M66B]

Looking at the log and mounts it seems to me that XPrivacy works as should.
For you and me and probably others too it is confusing what is 'media storage'.
Read this to get more insight:
http://www.chainfire.eu/articles/113/Is_Google_blocking_apps_writing_to_SD_cards_/

[unclefab]

Thanks for this article, everything became clear.
Restricting sdcard will block internal and external media storage (both considered as sdcard, namely primary-internal and secondary-external), but not internal system (/efs, /dev, /system and stuff) files since as you said they can't be restricted.
Allright, but what about restricting media?
I made further tests and I found out that restricting it will make the external sdcard read only.
So maybe it should be renamed something like "write ext sd"?

[M66B]

Renaming would result in problems for existing users.
I have referenced the article from here:
https://github.com/M66B/XPrivacy#restrictions