Android like any other platform, have various layer where lower layer provide services to upper layer. At the core is Linux Kernel. I will not go in details about Android overall architectural and assume that the reader have basic understanding of android platform.
This is for android platform engineer, who want to understand or enforce secure their new/existing file system. We will first understand the lower level file system permission model in android and then see how it mapped to enforce permission in application layer.
Low Level File System Permission Model:
In Android every application is assigned a unique user ID (UID). Also, several user can combine to form a group with a unique ID called Group ID (GID).
You can check Group id associated with UID using "adb shell" id command.
$ id
uid=2000(shell) gid=2000(shell)
groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
Now, let's see in-term of file system permission. Android ( as in Linux ), each file and directory have three user based permission groups:
Owner: Owner permissions (UID).
Group: Group permissions ( GID).
All User ( World ): Others.
Generally, on Android in init.rc file we mount file system and enforce permissions.
Mapping Low Level File System Permission to Application Permission:
Define file system group id in below file:
Example :
This is for android platform engineer, who want to understand or enforce secure their new/existing file system. We will first understand the lower level file system permission model in android and then see how it mapped to enforce permission in application layer.
Low Level File System Permission Model:
In Android every application is assigned a unique user ID (UID). Also, several user can combine to form a group with a unique ID called Group ID (GID).
You can check Group id associated with UID using "adb shell" id command.
$ id
uid=2000(shell) gid=2000(shell)
groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
Now, let's see in-term of file system permission. Android ( as in Linux ), each file and directory have three user based permission groups:
Owner: Owner permissions (UID).
Group: Group permissions ( GID).
All User ( World ): Others.
Generally, on Android in init.rc file we mount file system and enforce permissions.
Mapping Low Level File System Permission to Application Permission:
Define file system group id in below file:
/system/core/include/private/android_filesystem_config.h
For mapping a permission with group id, we need to Included a xml file in /system/etc/permissions/
For mapping a permission with group id, we need to Included a xml file in /system/etc/permissions/
Example :
<permission
name="android.permission.XYZ" >
<group gid="xyz" />
</permission>
We can further enhance protection by define android:protectionLevel ( Like "signatureOrSystem").
Also, we can consider having two group ( one for read and another for write ).
Now, at application level if some need to use your file system, he or she need to include permission in their Android Manifest(In our case "android.permission.XYZ" ). By doing so it will be included in low level group ( In our case "xyz").
Also, we can consider having two group ( one for read and another for write ).
Now, at application level if some need to use your file system, he or she need to include permission in their Android Manifest(In our case "android.permission.XYZ" ). By doing so it will be included in low level group ( In our case "xyz").
