Xprivacy is leaking complete storage - even when access denied

[T-vK]

I just found out that even if you restrict access to the whole Storage category, apps can still access/read/write/modify any files/folders they want.
That includes the folders that hold all of my Photos, Videos, WhatsApp messages/media, Music, .... basically just everything.

Please tell me this is a bug and not expected behavior.

Leaking my location is one thing... but leaking all my data that I have stored is 1000 times worse.

[M66B]

First of all please read the support section on GitHub.

Did you restart the applications?

[T-vK]

Yes, I read the whole readme at some point.
If you want details:

My default template restricts everything [X] [?].

Reproduce with "Simple Explorer":

• Install it, whitelist IPackage:getPackageInfo, deny everything else. It will be able to access the file system.

Reproduce with "QPython":

• I installed QPython.
• I manually enabled the inet restriction because Xprivacy doesn't create a prompt for that (another bug btw?)
  -When it asked for IPackage:getPackageInfo, I whitelisted that.
  -I denied every other permission.
  -I went into the Editor of QPython
  -I clicked the icon to save the script

I was able to save my script wherever I want and I was also able to delete any files... and everything happened within QPython.

Note: QPython does complain there is no SD Card, but you can ignore that message and access it anyway.

https://f-droid.org/repository/browse/?fdid=com.dnielfe.manager
https://github.com/qpython-android/qpython

[M66B]

Please read the support section again. In short: first ask on XDA before reporting a bug.

[M66B]

Did you also restrict the dangerous restrictions, especially 'sdcard' and restarted the applications?

[T-vK]

Yes. As I said my 'default template' automatically restricts everything including the ones with a red background (including sdcard). So the restrictions are applied before newly installed applications start for the first time. But yes I also restarted the applications. The result was always the same.

Btw I should mention that I don't have a physical sdcard in my phone. I have the /storage/emulated/0 directory which is the emulated sdcard from what I understand. That's also the directory that all apps can recursively access btw.

[M66B]

Which device? Which Android version? Which Xposed version?

[walrus543]

Nexus 5 - Android 6.0.1 - Xposed v86 - XPrivacy 3.6.19
All access from Storage are denied.
Tested with another file manager (MiXplorer).

[T-vK]

Device: OnePlus One
Android version: 6.0.1 (CyanogenMod 13.0-20160819)
Xposed version: 3.0 alpha4

@Primokorn

All access from Storage are denied.

Do you mean that the access is actually denied now or do you mean that you denied it with Xprivacy, but MiXplorer can access it anyways?

[walrus543]

The latter.
I recorded a video for another issue but you can see the Storage category.
MiXplorer can still create files and folders.

[M66B]

To diagnose this problem I need to see a logcat captured from your PC using ADB, started before you turn the device on.