1 <html devsite> 2 <head> 3 <title>Storage</title> 4 <meta name="project_path" value="/_project.yaml" /> 5 <meta name="book_path" value="/_book.yaml" /> 6 </head> 7 <body> 8 <!-- 9 Copyright 2017 The Android Open Source Project 10 11 Licensed under the Apache License, Version 2.0 (the "License"); 12 you may not use this file except in compliance with the License. 13 You may obtain a copy of the License at 14 15 http://www.apache.org/licenses/LICENSE-2.0 16 17 Unless required by applicable law or agreed to in writing, software 18 distributed under the License is distributed on an "AS IS" BASIS, 19 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 20 See the License for the specific language governing permissions and 21 limitations under the License. 22 --> 23 24 25 26 <img style="float: right; margin: 0px 15px 15px 15px;" src="images/ape_fwk_hal_extstor.png" alt="Android external storage HAL icon"/> 27 <p>Android has evolved over time to support a wide variety of storage device types 28 and features. All versions of Android support devices with <a href="/devices/storage/traditional.html">traditional storage</a>, 29 which includes portable and emulated storage. <em>Portable</em> storage can be provided by physical media, like an SD card or USB, that is for 30 temporary data transfer/ file storage. The physical media may remain with the 31 device for an extended period of time, but is not tied to the device and may be 32 removed. SD cards have been available as portable storage since Android 1.0; 33 Android 6.0 added USB support. <em>Emulated</em> storage is provided by exposing a portion of internal storage through an 34 emulation layer and has been available since Android 3.0.</p> 35 36 <p>Starting in Android 6.0, Android supports <a href="/devices/storage/adoptable.html"><em>adoptable</em> storage</a>, which is provided by physical media, like an SD card or USB, that is 37 encrypted and formatted to behave like internal storage. Adoptable storage can 38 store all types of application data. </p> 39 40 <h2 id=permissions>Permissions</h2> 41 <p>Access to external storage is protected by various Android 42 permissions. Starting in Android 1.0, write access is protected with the 43 <code>WRITE_EXTERNAL_STORAGE</code> permission. Starting in Android 4.1, 44 read access is protected with the <code>READ_EXTERNAL_STORAGE</code> 45 permission.</p> 46 <p>Starting in Android 4.4, the owner, group and modes of files on external 47 storage devices are now synthesized based on directory structure. This 48 enables apps to manage their package-specific directories on external 49 storage without requiring they hold the broad 50 <code>WRITE_EXTERNAL_STORAGE</code> permission. For example, the app with 51 package name <code>com.example.foo</code> can now freely access 52 <code>Android/data/com.example.foo/</code> on external storage devices with 53 no permissions. These synthesized permissions are accomplished by wrapping 54 raw storage devices in a FUSE daemon.</p> 55 56 <h3 id=runtime_permissions>Runtime permissions</h3> 57 58 59 <p>Android 6.0 introduces a new <a href="/devices/tech/config/runtime_perms.html">runtime permissions</a> model where apps request 60 capabilities when needed at runtime. Because the new model includes the <code>READ/WRITE_EXTERNAL_STORAGE</code> permissions, the platform needs to dynamically grant storage access without 61 killing or restarting already-running apps. It does this by maintaining three 62 distinct views of all mounted storage devices:</p> 63 64 <ul> 65 <li><code>/mnt/runtime/default</code> is shown to apps with no special storage permissions, and to the root 66 namespace where <code>adbd</code> and other system components live. 67 <li><code>/mnt/runtime/read</code> is shown to apps with <code>READ_EXTERNAL_STORAGE</code> 68 <li><code>/mnt/runtime/write</code> is shown to apps with <code>WRITE_EXTERNAL_STORAGE</code> 69 </ul> 70 71 <p>At Zygote fork time, we create a mount namespace for each running app and bind 72 mount the appropriate initial view into place. Later, when runtime permissions 73 are granted, <code>vold</code> jumps into the mount namespace of already-running apps and bind mounts the 74 upgraded view into place. Note that permission downgrades always result in the 75 app being killed.</p> 76 77 <p>The <code>setns()</code> functionality used to implement this feature requires at least Linux 3.8, but 78 patches have been backported successfully to Linux 3.4. The <code>PermissionsHostTest</code> CTS test can be used to verify correct kernel behavior.</p> 79 80 <p>In Android 6.0, third-party apps dont have access to the <code>sdcard_r</code> and <code>sdcard_rw</code> GIDs. Instead, access is controlled by mounting only the appropriate runtime 81 view in place for that app. Cross-user interactions are blocked using the <code>everybody</code> GID.</p> 82 83 </body> 84 </html> 85
