All files access - MANAGE_EXTERNAL_STORAGE

swdev4anonymity

Dear Graphene OS community,

I have a question in regard to how the security of the Graphene OS / System
can be influenced by granting an application "All files access".

My situation:

I installed an application using sandboxed Google Play Store store
This application asked for "All files access" permission and I granted
this app this permission.
After a while I revoked these rights again

My questions now are:

Is it possible that the corresponding app had the "chance" to modify the root directory
in a way that the smartphone's security / safety is (permanently) jeopardized?
Is it possible that this app had the chance to modify the system in a way which reduces
the anonymity of its user?
Is it possible to check the Operating System's current state? I.e. if any modification
of this app has already been made?

I would be very grateful for my questions being answered.

With kind regards

unwat

swdev4anonymity This application asked for "All files access" permission and I granted this app this permission.

That's what Storage Scopes is for. Storage Scopes is a feature added by GrapheneOS to make an app think it has access to the entire filesystem when it really doesn't. For apps that ask for access, I just turn on Storage Scopes, but don't add any folders or files unless the app needs access to them.

You can read about Storage Scopes here: https://grapheneos.org/features#storage-scopes

swdev4anonymity Is it possible that the corresponding app had the "chance" to modify the root directory in a way that the smartphone's security / safety is (permanently) jeopardized?
swdev4anonymity Is it possible that this app had the chance to modify the system in a way which reduces
the anonymity of its user?

It's virtually impossible for both of these things to happen, assuming you followed the instructions when setting up GrapheneOS and didn't modify anything later.

swdev4anonymity Is it possible to check the Operating System's current state? I.e. if any modification of this app has already been made?

Yes, you can set up regular verification of the integrity of your OS by using the Auditor app. You can set it up very easily by following these instructions under scheduled remote verification. If your phone ever fails the remote attestation, the system will send you an email to notify you.