Search code examples
androidandroid-source

AOSP Permission denied when creating file on /data

In Android 6.0 I am trying to create an empty file in a sample folder at the /data partition: /data/sample/emptyfile.

The code is run from a library installed in /external 

File file = new File(/data/sample/emptyfile);

try {
    file.createNewFile();
} catch (IOException e) {
    e.printStackTrace();
}

I have assigned the proper permissions to the sample folder at /system/core/libcutils/fs_config.c source

I have tried adding the following code variants:

/* Rules for directories.
** These rules are applied based on "first match", so they
** should start with the most specific path and work their
** way up to the root.
*/

static const struct fs_path_config android_dirs[] = {
{ 00777, AID_ROOT, AID_ROOT,     0, "data/sample" },
{ 00770, AID_SYSTEM, AID_CACHE,  0, "cache" },
... etc.

and at:

/* Rules for files.
** These rules are applied based on "first match", so they
** should start with the most specific path and work their
** way up to the root. Prefixes ending in * denotes wildcard
** and will allow partial matches.
*/
static const char conf_dir[] = "/system/etc/fs_config_dirs";
static const char conf_file[] = "/system/etc/fs_config_files";

static const struct fs_path_config android_files[] = {
    { 00777, AID_ROOT,      AID_ROOT,      0, "data/sample/*" },
    { 00440, AID_ROOT,      AID_SHELL,     0, "system/etc/init.goldfish.rc" },
    ... etc.

I tried using both AID_ROOT, AID_ROOT and AID_SYSTEM, AID_SYSTEM

The folder sample is created successfully on compile time and the permissions are: drw-rw-rw- according to the file explorer (there is no execute permission even though I assigned 777).

Still, when trying to create a file logcat prints:

02-27 17:33:30.097: W/System.err(1939): java.io.IOException: open failed: EACCES (Permission denied)
02-27 17:33:30.097: W/System.err(1939):     at java.io.File.createNewFile(File.java:939)
02-27 17:33:30.097: W/System.err(1939):     at com.android.incallui.InCallPresenter (...)
02-27 17:33:30.097: W/System.err(1939):     at com.android.incallui.CallList.notifyGenericListeners(CallList.java:541)
02-27 17:33:30.097: W/System.err(1939):     at com.android.incallui.CallList.onUpdate(CallList.java:188)
02-27 17:33:30.098: W/System.err(1939):     at com.android.incallui.Call.update(Call.java:311)
02-27 17:33:30.098: W/System.err(1939):     at com.android.incallui.Call.-wrap0(Call.java)
02-27 17:33:30.098: W/System.err(1939):     at com.android.incallui.Call$1.onDetailsChanged(Call.java:208)
02-27 17:33:30.098: W/System.err(1939):     at android.telecom.Call$4.run(Call.java:1156)
02-27 17:33:30.098: W/System.err(1939):     at android.os.Handler.handleCallback(Handler.java:739)
02-27 17:33:30.098: W/System.err(1939):     at android.os.Handler.dispatchMessage(Handler.java:95)
02-27 17:33:30.098: W/System.err(1939):     at android.os.Looper.loop(Looper.java:148)
02-27 17:33:30.098: W/System.err(1939):     at android.app.ActivityThread.main(ActivityThread.java:5417)
02-27 17:33:30.098: W/System.err(1939):     at java.lang.reflect.Method.invoke(Native Method)
02-27 17:33:30.098: W/System.err(1939):     at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
02-27 17:33:30.098: W/System.err(1939):     at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
02-27 17:33:30.098: W/System.err(1939): Caused by: android.system.ErrnoException: open failed: EACCES (Permission denied)
02-27 17:33:30.098: W/System.err(1939):     at libcore.io.Posix.open(Native Method)
02-27 17:33:30.098: W/System.err(1939):     at libcore.io.BlockGuardOs.open(BlockGuardOs.java:186)
02-27 17:33:30.098: W/System.err(1939):     at java.io.File.createNewFile(File.java:932)
02-27 17:33:30.098: W/System.err(1939):     ... 16 more
Solution

  • Just because you have DAC (rwx) permission in Android, doesn't mean that you have the appropriate SELinux permissions. Since you are getting an EACCES, and if your file truly is 777, my guess is that you are getting an SELinux denial at trying to access it. Logcat or dmesg should have an avc denial if you are getting a denial.

    Its possible that there are guards in place somewhere in AOSP to prevent a world-writable or world-readable dir or file. Try to drop your permissions to something reasonable like 00771 for the dir and 00644 for the files.

    Making a file world-readable or world-writable is a terrible, usually unnecessary, idea anyways.