~# chcon u:object_r:sdcardd_exec:s0 sdcard.bin ~# chcon u:object_r:system_file:s0 sdcard
Or to make changes permanent, replace sdcard binary with a shell script: ~# cd /system/bin/ mv sdcard sdcard.bin touch sdcard ~# /system/bin/sdcard -u 1023 -g 1023 -m -w -G /data/media emulated You can mount the emulated filesystem without default_normal option: ~# umount /mnt/runtime/*/emulated HOW TO ACCESS MULTIPLE-USERS FILES FROM ADB? However the exception has been removed in Android 9 using mount option default_normal. So adb was able to read these directories. However up to Android 8 there was an exception to the above rule: to all the processes running in root mount namespace (non-app processes), sdcardfs always returned the directories /storage/emulated/ owned by GID 1015. Since adbd is member of only 1015 GID, it can read only device owner's files, not of secondary users. It means that non-root processes can read the directories only if they are members of supplementary groups: 0001015, 1001015, 11001015 and so on, "others" can only traverse the directories. The device owner's (User_ID: 0) files in /storage/emulated/0 have ownership root:sdcard_rw (0:1015) and permission mode 0771, while secondary profile/user's (say with User_ID: 10) files in /storage/emulated/10 have ownership 0:1001015. For details please see What is the “u#_everybody” UID? and What is /storage/emulated/0/?.ītw, my /sdcard/ always points to the first user's space /storage/emulated/0 at adb shell regardless what my current user is at mobile UI.įor all native processes running in root mount namespace (including adbd), /sdcard is a symlink to /storage/emulated/0 and /storage/emulated is bind mounted from /mnt/runtime/default. Apps belonging to secondary as well as primary user have isolated mount namespaces. It's achieved through mount namespaces and different VIEWs of /data/media mounted in /mnt/runtime/. The whole story is about Android's filesystem emulation in order to have a permission-less directory ( /sdcard) which makes file sharing among multiple UNIX users (apps) possible. The default_normal option causes mounts with the gid set to AID_SDCARD_RW to have user specific gids, as in the normal case. What the mount option default_normal does in sdcardfs is explained here: This new flag isolates each user on a multi-user device for security reasons. WHY IS ADB DENIED ACCESS TO MULTI-USER STORAGE?Īccess to /storage/emulated/10 is denied from adb shell due to this change in Android 9:
0 kommentar(er)
