Element app (matrix client) gets storage permission without asking?

tralala

Hello,
I recently bought a Pixel 4a and flashed GrapheneOS. Could someone explain me how the permissions in Android are requested and granted? I'm asking because I found the following issue: I downloaded the matrix client Element from the fdroid website (version 1.5.11). Although it required a ton of permissions, I decided that they could be blocked by the app settings in the OS. When installed, the phone warned me only about the access to the network which I denied. In the app settings every other permission was denied by default. I created some accounts and tested the communication. I allowed only access to notifications, sensors and network. When I tried to make a call I got a pop-up requesting access to the microphone. So far everything seemed alright. Then I decided to send a file. There is no permission request by the app for accessing the images/music or storage in general. Nevertheless the file transfer went OK. I never got prompted for access to the storage. So basically the app gets access to the filesystem by default and I cannot deny it. The same happens if you use a verification code in the app - you could store it on the device as file and then go ahead and read it. I am not familiar with Android, so my expectation was that the OS sort of "firewalls" the requests to certain functionalities, as they could only be accessed by a certain API. Is this not the case? By the way I do get a permission prompt if I try to use the camera/send location/send contacts in Element. Just for reference, I am running on the 2022121400 update.

unwat

tralala

There are kind of two approaches to handling files in Android. One is an app gets direct access to the file system, another approach is to use a file picker. Element uses the file picker. Basically, you gave element access to that file when you "opened" it.

Also, all apps can save files to certain folders even without asking for access. Element saves the recovery key file to one of those folders. Since element created that file, it can open it again. But, element cannot see any other files that it didn't create.

So, what you're describing is all expected behavior and element hasn't obtained any special access.

tralala

Thank you very much for the detailed explanation :)