Potential vulnerability with storage scopes?

Geodude365

Downloaded VLC, and the in app option asking to scan for all media works without me ever needing to give it permission in settings. It only has access to sensors yet still detects all my videos. This only seems to be the case on my second profile, on my main profile (owner profile) it works fine. I have VLC installed on both profiles. Is it just a profile related bug? Is it intentional? Is it even related to it being on a different profile? Or is there some kind of vulnerability?

unwat

Geodude365

I just tried on my phone and it works as expected.

Your post says it only has access to sensors, but the title suggests you have storage scopes enabled as well? Have you added any folders or files to your storage scopes settings?

Like here are my settings and what I see:

As you can see, nothing is showing up.

matchboxbananasynergy

Geodude365 You've given VLC the special app permission to manage all files and don't remember it. This is not any kind of vulnerability or issue with Storage scopes.

Go to Settings > Apps > Special app access > All files access. If my guess is correct, you'll see VLC as "allowed" there. Deny it that permission. Then, launch VLC again. It'll prompt you for that special app permission again, but you'll see the option to configure storage scopes instead. Feel free to do so.

VLC should not be requesting that special permission, it feels unneeded.

[deleted]

unwat not sure if I understood how storage scopes works.
If I deny access to images/music for my music app but I grant storage scopes access then I add the folder /sdcard/Music to the app storage scopes the app can only access to files inside this folder and no other? is that?
Thanks

Geodude365

unwat

unwat Everything works exactly how I expect on my main profile, but on my second profile it doesn't even give me the ability to manage it's storage permissions. Like, it's not even there. And when it scans for media it detects all media on the profile. On that profile it seems to have full access but the option to stop it from having access is not there. Maybe it's because it's conflicting with my main profile somehow, where storage scopes are set up and everything works perfectly?

unwat

[deleted]

In your example since you added the /sdcard/Music folder, that app can view all folders, sub folders, and files in that folder.

That app can also view some standard folders that all Android profiles' homes have, but they're empty.

The app can also create folders and save files almost anywhere it wants in the profile, then see the folders or files it creates.

Geodude365

matchboxbananasynergy Hey you're right about the special access part, now that I've denied it VLC no longer shows me anything and instead requests for special access. Great to see there's no vulnerability! However, there is still no option for storage scopes or even the permission for photos and videos. Any idea as to why? I appreciate the help a lot btw thanks a bunch!

matchboxbananasynergy

Geodude365 After denying the special app permission and launching the VLC app, you should be prompted on app launch with a window to grant it access to all files. There, you should see an option to "configure storage scopes". You can click on that to enable it for VLC

You won't see other storage permissions in settings > apps > permissions because VLC doesn't request those, it only requests the all files special app permission instead

Geodude365

matchboxbananasynergy Ah ok I did it now you're 100% spot on as usual :) little quirk in the UI is all it was then, thank you! :)

avidgrapher

This is a UI nitpick with GOS, but I think if an app is given a scope access, then GOS should show in the "App Info" that this app has "partial media access" permission instead of showing that the app has no permissions allowed.

All my apps are scoped. This way I can't really distinguish who has a partial media permission from apps that don't have any permissions.

GrapheneOS

avidgrapher Storage Scopes is not a permission. Apps given access via the Storage Access Framework (system file picker) aren't shown as having permissions since they don't have them. There's no reason Storage Scopes should be listed there when SAF access is not listed. In fact, there is essentially no graphical interface for viewing SAF granted access at all.