tree 77b77be068063653ecd3dae7704ff65877c839c3
parent 04bb17f11237f5d960ffba66d0c0ea4ff5070f7b
author Martijn Coenen <maco@google.com> 1581421045 +0100
committer Martijn Coenen <maco@google.com> 1581509924 +0100

Set default ACL on application-specific directories.

On devices without sdcardfs, application-specific directories have a
particular GID that ensure some privileged daemons (like installers) are
able to write to them. Android applications however run with a umask of 0077, which means that
any subdirectory they create within their app-specific directory has
mode 700, which in turn prevents things like DownloadManager from
working, since it can be asked to download into a subdir of the app's
private storage.

To prevent this from happening, set a default 770 ACL on the top-level
app-specific directory (eg, /data/media/0/Android/data/com.foo); the
effect of that default ACL is that all directories that are created
within these directories automatically get a 770 mask, regardless of the
umask that the process has.

Bug: 146419093
Test: atest FuseDaemonHostTest on cf_x86 (without sdcardfs)

Change-Id: I3178694e6d25ce3d04a0918ac66862f644635704