Apps have access to Internal storage despite storage scopes

Hanna

roamer4223 Thanks for your fast answer!

Okay so an app can create files anywhere no matter the permissions set and also access that file there? That app can without any permissions set only access the files and read the files it created but no other files?

Am I understanding this right?

roamer4223

Hanna Yes I think you have summarised it very well.

If I am misinformed, or missed a crucial detail, I'm sure someone will be along soon to correct me. (Though I do believe I'm right in this)

Edit: to be very clear, when you say 'anywhere', that is anywhere in the general shared storage, not in another app's private storage. I suppose that's stating the obvious though

Dumdum

roamer4223 Though I do believe I'm right in this)

Yes.

Hanna

roamer4223 Thanks for helping me!:)

Dumdum

https://grapheneos.org/usage#storage-access

Without any storage permission, an app is allowed to:

create media files in standard directories (audio in Music/, Ringtones/, etc, images in Pictures/ and DCIM/, videos in DCIM/ and Movies/)

create files of any type (both media and non-media) in Documents/ and Download/

create new directories inside standard directories

rename/delete files that were created by the app itself

rename/delete directories if it can rename/delete all files within those directories

Hanna

Dumdum Thanks for the reference. Should've looked on the GrapheneOS website first.

roamer4223

Dumdum thank you very much for confirming that, and also thank you for giving the more specific details above!

DeletedUser495

You should also take into consideration not to store any files you don't want to be accessed by literally any app in the shared storage (i.e. standard folders), but create your own file structure for their storage.

FaberCastell

DeletedUser495 create your own file structure for their storage

How do you do this?
I can create a new folder, but have no idea how to direct a particular app's saved items to it...

Hanna

DeletedUser495 I thought no app can access/ read any files in the shared storage or standard folders?

The linked documentation provided by @Dumdum states that any app can create media files and only rename and delete files it created.

It doesn't say at all that it can access meaning read other files in that shared storage which it hasn't created itself.

Or am I misunderstanding something now?

roamer4223

Hanna @FaberCastell

no, I believe @DeletedUser495 is incorrect. As I pointed out earlier and then confirmed by @Dumdum using official documentation, this is not how it works.

There is nothing wrong with creating folders in a manner like this, if you prefer organising folders like that.

Just make sure to avoid giving any app permission to access all files and continue to use storage scopes

Hanna

roamer4223 Yes right! Thank you again I got it now.

DeletedUser495

I believe I was mistaken, app can access only files in shared store it owns.

https://developer.android.com/training/data-storage/shared/media

roamer4223

Think this can be marked as solved :)

other8026

I think the features page describes Storage Scopes pretty accurately:

Instead of granting storage permissions, users can enable Storage Scopes to make the app assume that it has all storage permissions that it asked for. On Android, an app that doesn't have any storage permissions is still allowed to create files and directories, and is allowed to access the files that it created.

Note that it doesn't say anything about "blocking" access to anything.

lah23

I do not quite underatand this feature either. When setting up these scopes, apps gain additional access, but not lose access to any default directories.

When I use Libre version of LibreTorrent and set Storage Scopes, it allows me to use 2 folders - Download and the scoped one. Without setting up scopes, it only lets me select Download folder.

Non-Libre version (from Google Play Store) does not allow for scopes at all and downloads exclusively to Download folder.

You'd think scoped storage would allow you to set an exclusive directory access and block all other directories, but scoped storage allows for inclusive access and use of default and custom directories.