Question on storage permissions

[IzzySoft]

I just checked today's release with my scanner and got:

! repo/com.drdisagree.iconify_17.apk declares risky permission(s): android.permission.READ_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE

Is there an explanation somewhere what those two are needed for (or rather what need they indicate; of course a rooted app could access almost anything)?

[Mahmud0808]

Is there an explanation somewhere what those two are needed for (or rather what need they indicate; of course a rooted app could access almost anything)?

These permissions are required to store files on internal storage like font, image etc for the xposed mod as storing them in app files directory isn't accessible from xposed. Also it's required for building overlays as iconify builds every single overlay right on the phone's internal storage, then zips them into a module and automatically flashes it in magisk or kernelsu.

[IzzySoft]

Thanks! And none of the locations "easily" accessible by SAF can cover that? Again, just a honest question from someone not that familiar with the "internals". If I understood correctly, READ_EXTERNAL_STORAGE became a "NOP" (i.e. non-operational, being ignored) somewhere between Android 12 and 14 (the range Iconify currently covers), and MANAGE_EXTERNAL_STORAGE is giving quite wide access (and e.g. needed to access Downloads/).

as storing them in app files directory isn't accessible from xposed

So Iconify stores them in app files directories, and that's what it needs MANAGE_EXTERNAL_STORAGE for? Seems to match what I learned until now then.

[Mahmud0808]

The first few versions of iconify used to work on android 10 and 11 too. That's why I added READ_EXTERNAL_STORAGE, after a few versions I bumped the minSdk to android 12. But I haven't removed the permission hoping to not break anything unexpectedly and the permission was ignored by android anyway, so just left it there.

So Iconify stores them in app files directories, and that's what it needs MANAGE_EXTERNAL_STORAGE for? Seems to match what I learned until now then.

App files directories need no permission at all afaik, but I had issues while keeping files in there and trying to build overlays. So with the help of MANAGE_EXTERNAL_STORAGE, iconify creates a hidden .iconify_files folder right inside the internal storage, and keeps all the required files there. Also any overlay building process and the font/image etc required for xposed mod are also stored there. This method works without any issue unlike files directory.

[IzzySoft]

Thanks! With MANAGE_EXTERNAL_STORAGE explained, I'd say READ_EXTERNAL_STORAGE bears no "extra risks. I guess you'd remove that one later should you bump minSdkVersion again, making it a NOP? I guess it's worth trying without it already now, as Android 12+ is needed to use the app:

On Android 11 the directives for accessing the entire external storage are deprecated and ignored by the system.

(source) Though that article might be off by two versions, as this GoogleBlog article indicates:

<!-- Devices running up to Android 12L -->
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="32" />

So I'm fine just mentioning that ("compatibility with lower Android versions"), leaving it for "the next bump". Thanks a lot for the explanations!

PS: Does one close discussions as one closes issues? Then I'd say this one is "solved" 😄

[Mahmud0808]

Okay I am closing the discussion.