3 ms·

The problem lies that in newer Android versions (11 or higher) you cannot give permissions to arbitrary folders, it's only "shared folders" or "all the files" [

The problem lies that in newer Android versions (11 or higher) you cannot give permissions to arbitrary folders, it's only "shared folders" or "all the files" [0][1] (It's also explained in TFA) I'm sure they would happily allow you to select the folders you want to give permissions to, but I think that's not possible anymore. So if you want to sync a local data folder that stores, for example, the tracks you record with your GPS, you cannot do it without full access unless your GPS app allows you to select a shared folder to store its data. 0: https://developer.android.com/about/versions/11/privacy/storage 1: https://www.theregister.com/2025/05/13/nextcloud_play_store_complaint/ edit: restructured a confusing sentence

izacus 1y ago
You're misrepresenting things I think. You can select any file you could before on shared external storage. You can't select private app directories which were always off limits from other apps just like on iOS.
- tecleandor 1y ago
  From what I see (and what I've experienced on different sync apps when upgrading Android versions, although I'm not a developer, just a user), access to /Android/data and /Android/obb changed on Android 11: --- [0] On Android 11 (API level 30) and higher, you cannot use the ACTION_OPEN_DOCUMENT_TREE intent action to request access to the following directories: - The root directory of the internal storage volume. - The root directory of each SD card volume that the device manufacturer considers to be reliable, regardless of whether the card is emulated or removable. A reliable volume is one that an app can successfully access most of the time. - The Download directory. Furthermore, on Android 11 (API level 30) and higher, you cannot use the ACTION_OPEN_DOCUMENT_TREE intent action to request that the user select individual files from the following directories: - The Android/data/ directory and all subdirectories. - The Android/obb/ directory and all subdirectories. --- [1] On Android 11 (API level 30) and higher, you cannot use the ACTION_OPEN_DOCUMENT intent action to request that the user select individual files from the following directories: - The Android/data/ directory and all subdirectories. - The Android/obb/ directory and all subdirectories. --- 0: https://developer.android.com/training/data-storage/shared/documents-files#document-tree-access-restrictions 1: https://developer.android.com/training/data-storage/shared/documents-files#document-access-restrictions --- edit: fixed readability and a link
  - izacus 1y ago
    /Android is a private app storage and is documented as such.
    - tecleandor 1y ago
      Yeah, yeah, I know. I'm not saying that it's good or bad, I just say that some people like to sync/backup/copy their apps data (that sometimes it's located on private directories, or in the Downloads folder...), and they were able to do it before. And that the new API has less permissions than the one that Google wants them to use. Google Play, or at least that's what they say in their docs, might allow the use of the MANAGE_EXTERNAL_STORAGE "all files" API call "...if your app includes a use case similar to any of the following: File managers, Backup and restore apps, [...] Document management apps ..." [0][1]. And the Nextcloud app sounds very similar to that. Of course, it's all "Subject to Google Play review and approval.", but why they used to grant that permission to Nextcloud with no problem and revoked it suddenly... I have no idea. --- 0: https://developer.android.com/training/data-storage/manage-all-files#all-files-access-google-play 1: https://support.google.com/googleplay/android-developer/answer/10467955#zippy=%2Cpermitted-uses-of-the-all-files-access-permission
      - izacus 1y ago
        Note that `MANAGE_EXTERNAL_STORAGE` permission doesn't allow access to /Android anymore either (it's blocked by OS permisisons) so it won't help Nextcloud to retain it either. Thing is, Nextcloud doesn't need that permission since they can do what they do now with SAF which is how Google determines eligibility for the exception. That is - if you can do it with SAF, you don't need complete access to all private data via MANAGE permission.
deng 1y ago
I think TFA is wrong. It is correct that you cannot access private app folders, meaning stuff like /data/data, /Android/data, /Android/obb. But this is nothing new and you basically need a rooted device to access them. You can however access anything on external storage, which is typically where apps would store data you would want to sync and which would cover by far most use cases from users. At the moment, users are mostly complaining that only media files are synced, but not documents. SAF would solve this. > I'm sure they would happily allow you to select the folders you want to give permissions to, but I think that's not possible anymore. That is absolutely possible: https://developer.android.com/training/data-storage/shared/documents-files#grant-access-directory https://developer.android.com/training/data-storage/shared/d...
- tecleandor 1y ago
  Well, it used to be possible before Android 11, that's the thing. So, following a bit the example I was giving, if you want to sync data from another app to backup it (or whatever), and that App stores its data in the default data folder assigned by Android, since Android 11 it's going to be very difficult to do it. I used to sync some of those folders with Syncthing in Android, and since Android 11 things have gotten complicated (meaning, you need 'all files' access, and even then, some things might not be accessible). [0] 0: https://forum.syncthing.net/t/android-11-and-syncthing-what-can-be-synchronised/17100/2
  - nolist_policy 1y ago
    Hello, we and TFA are talking about the new API where the user picks what directory an app has access to vs. the old API where the app has access to almost everything as you pointed out. The Google Play store (not Android the OS) is now limiting access to the old API, it has nothing to do with Android 11. The new API does not work with Linux open(). Some projects (like Syncthing) don't want to put in the work to switch to the new API. I hope that clears things up.
    - tecleandor 1y ago
      Yeah, I'm not saying that you're in the wrong, I'm saying that they might want to access further than the new `ACTION_OPEN_DOCUMENT_TREE` API call allows. For example, the Downloads folder (you can only open individual files with ACTION_OPEN_DOCUMENT, not the whole folder). And that can be reached with the `MANAGE_EXTERNAL_STORAGE` (all files) API. Is that OK? Well, it's not intrinsically bad, but it clashes with Google's Android hardening directives. Not very familiar with the NextCloud client, as I haven't used it much, but in the case of Syncthing (and this is totally guessing from what I remember from reading the forums back when the Android 11 upgrade happened): I don't think they don't want to put the work to switch to the new API, I think they want to access places they won't be able to access with the new API, so that's why they won't change the calls.
jeroenhd 1y ago
KDE Connect allows me to browse the folder I picked and upload/download files just fine, using SAF. You point the app at a directory, click "grant access", and you have permanent access. The only problem I can think of is that some directories are restricted (https://developer.android.com/about/versions/11/privacy/storage#file-directory-restrictions https://developer.android.com/about/versions/11/privacy/stor...) because they're a dumping ground for files already. SAF provides both provider and consumer APIs, and from the language NextCloud uses, I get the feeling they might've missed the consumer API here. Had NextCloud said "we want the user to be able to select the Download folder and certain external media directories" then I would've thought the restrictions are the main problem, but that doesn't seem to be the case here.
- tecleandor 1y ago
  This is all guessing by me, but I think that, traditionally, there's been a certain quantity of users that synced folders out of the /Android/data or similar locations and/or needed some extra flexibility. When Android 11 arrived, it was difficult to break that workflow for all those users (and I guess there was also some re-architecture needed for the app, but I don't know how much would it be). I went through the same with Syncthing, and now I install it from out of Google Play, where it doesn't need Google approval to do the All Files Permission API call. I understand why the API changes and the hardening of the Android system, but it's also true you're locked out from certain folders even when on developer mode and it feels weird.
- apitman 1y ago
  It's worth noting that SAF does not work with native code.

izacus 1y ago

You're misrepresenting things I think. You can select any file you could before on shared external storage. You can't select private app directories which were always off limits from other apps just like on iOS.

tecleandor 1y ago
From what I see (and what I've experienced on different sync apps when upgrading Android versions, although I'm not a developer, just a user), access to /Android/data and /Android/obb changed on Android 11: --- [0] On Android 11 (API level 30) and higher, you cannot use the ACTION_OPEN_DOCUMENT_TREE intent action to request access to the following directories: - The root directory of the internal storage volume. - The root directory of each SD card volume that the device manufacturer considers to be reliable, regardless of whether the card is emulated or removable. A reliable volume is one that an app can successfully access most of the time. - The Download directory. Furthermore, on Android 11 (API level 30) and higher, you cannot use the ACTION_OPEN_DOCUMENT_TREE intent action to request that the user select individual files from the following directories: - The Android/data/ directory and all subdirectories. - The Android/obb/ directory and all subdirectories. --- [1] On Android 11 (API level 30) and higher, you cannot use the ACTION_OPEN_DOCUMENT intent action to request that the user select individual files from the following directories: - The Android/data/ directory and all subdirectories. - The Android/obb/ directory and all subdirectories. --- 0: https://developer.android.com/training/data-storage/shared/documents-files#document-tree-access-restrictions 1: https://developer.android.com/training/data-storage/shared/documents-files#document-access-restrictions --- edit: fixed readability and a link
- izacus 1y ago
  /Android is a private app storage and is documented as such.
  - tecleandor 1y ago
    Yeah, yeah, I know. I'm not saying that it's good or bad, I just say that some people like to sync/backup/copy their apps data (that sometimes it's located on private directories, or in the Downloads folder...), and they were able to do it before. And that the new API has less permissions than the one that Google wants them to use. Google Play, or at least that's what they say in their docs, might allow the use of the MANAGE_EXTERNAL_STORAGE "all files" API call "...if your app includes a use case similar to any of the following: File managers, Backup and restore apps, [...] Document management apps ..." [0][1]. And the Nextcloud app sounds very similar to that. Of course, it's all "Subject to Google Play review and approval.", but why they used to grant that permission to Nextcloud with no problem and revoked it suddenly... I have no idea. --- 0: https://developer.android.com/training/data-storage/manage-all-files#all-files-access-google-play 1: https://support.google.com/googleplay/android-developer/answer/10467955#zippy=%2Cpermitted-uses-of-the-all-files-access-permission
    - izacus 1y ago
      Note that `MANAGE_EXTERNAL_STORAGE` permission doesn't allow access to /Android anymore either (it's blocked by OS permisisons) so it won't help Nextcloud to retain it either. Thing is, Nextcloud doesn't need that permission since they can do what they do now with SAF which is how Google determines eligibility for the exception. That is - if you can do it with SAF, you don't need complete access to all private data via MANAGE permission.

deng 1y ago

I think TFA is wrong. It is correct that you cannot access private app folders, meaning stuff like /data/data, /Android/data, /Android/obb. But this is nothing new and you basically need a rooted device to access them. You can however access anything on external storage, which is typically where apps would store data you would want to sync and which would cover by far most use cases from users. At the moment, users are mostly complaining that only media files are synced, but not documents. SAF would solve this. > I'm sure they would happily allow you to select the folders you want to give permissions to, but I think that's not possible anymore. That is absolutely possible: https://developer.android.com/training/data-storage/shared/documents-files#grant-access-directory https://developer.android.com/training/data-storage/shared/d...

tecleandor 1y ago
Well, it used to be possible before Android 11, that's the thing. So, following a bit the example I was giving, if you want to sync data from another app to backup it (or whatever), and that App stores its data in the default data folder assigned by Android, since Android 11 it's going to be very difficult to do it. I used to sync some of those folders with Syncthing in Android, and since Android 11 things have gotten complicated (meaning, you need 'all files' access, and even then, some things might not be accessible). [0] 0: https://forum.syncthing.net/t/android-11-and-syncthing-what-can-be-synchronised/17100/2
- nolist_policy 1y ago
  Hello, we and TFA are talking about the new API where the user picks what directory an app has access to vs. the old API where the app has access to almost everything as you pointed out. The Google Play store (not Android the OS) is now limiting access to the old API, it has nothing to do with Android 11. The new API does not work with Linux open(). Some projects (like Syncthing) don't want to put in the work to switch to the new API. I hope that clears things up.
  - tecleandor 1y ago
    Yeah, I'm not saying that you're in the wrong, I'm saying that they might want to access further than the new `ACTION_OPEN_DOCUMENT_TREE` API call allows. For example, the Downloads folder (you can only open individual files with ACTION_OPEN_DOCUMENT, not the whole folder). And that can be reached with the `MANAGE_EXTERNAL_STORAGE` (all files) API. Is that OK? Well, it's not intrinsically bad, but it clashes with Google's Android hardening directives. Not very familiar with the NextCloud client, as I haven't used it much, but in the case of Syncthing (and this is totally guessing from what I remember from reading the forums back when the Android 11 upgrade happened): I don't think they don't want to put the work to switch to the new API, I think they want to access places they won't be able to access with the new API, so that's why they won't change the calls.

jeroenhd 1y ago

KDE Connect allows me to browse the folder I picked and upload/download files just fine, using SAF. You point the app at a directory, click "grant access", and you have permanent access. The only problem I can think of is that some directories are restricted (https://developer.android.com/about/versions/11/privacy/storage#file-directory-restrictions https://developer.android.com/about/versions/11/privacy/stor...) because they're a dumping ground for files already. SAF provides both provider and consumer APIs, and from the language NextCloud uses, I get the feeling they might've missed the consumer API here. Had NextCloud said "we want the user to be able to select the Download folder and certain external media directories" then I would've thought the restrictions are the main problem, but that doesn't seem to be the case here.

tecleandor 1y ago
This is all guessing by me, but I think that, traditionally, there's been a certain quantity of users that synced folders out of the /Android/data or similar locations and/or needed some extra flexibility. When Android 11 arrived, it was difficult to break that workflow for all those users (and I guess there was also some re-architecture needed for the app, but I don't know how much would it be). I went through the same with Syncthing, and now I install it from out of Google Play, where it doesn't need Google approval to do the All Files Permission API call. I understand why the API changes and the hardening of the Android system, but it's also true you're locked out from certain folders even when on developer mode and it feels weird.
apitman 1y ago
It's worth noting that SAF does not work with native code.