0

This says: "Any user can affect the installed apps for all users."

What does this mean?

I was concerned as to whether malware or any account from one user could affect anything from the other user. The previous statement: "No user has access to the app data of another user." seems to contradict this. In that a virus or other malicious application cannot affect the app data of another user. But if any user can install any application on all users, wouldn't this pose a security risk?

This seems to be contradicted by the fact that on a secondary user profile, when I go to Settings > Apps I can only see the apps for this secondary user. I cannot see any app that I installed on the primary user.

On the Primary user profile, when I navigate to "/storage/emulated", I cannot see any folders at all, let alone the one for this user profile (I think this is where user profiles are stored). This suggests that the contents of the Secondary user profile are not viewable by the Primary User Profile.

If you want to know what a Primary or Secondary profile is, refer to the link under "User types".

Improve this question

1 Answer 1

Reset to default
1

What meant here is. If the malware has installed itself as an application in system. It will affect the phone cross-users irrespectively. For a user installed app that contains malware also, it can affect users systemwide if the two users install the same application since Android shares the installation directory /data/app and the obb data at /sdcard/Android/obb/ which initially on a new user isn't visible but turns visible on install of any app that utilizes obb files. The application data files at /sdcard/Android/data are not mutual across users though. Remember a file to be a malware it must be a file that can be executed by phone. So files of media, pictures, text based files can't be malware in any way. That's why I have emphasized about an app. A file to be a malware should be at:

/data/app

If it's a user installed app

/system/app
/system/priv-app

If it's a system app

/system/bin
/system/xbin

If it's an auto-executing system binary

/system/framework

If it is a framework that is being used by system or third party app to render UI of ads or drawing over the system(adware) and installing apps without prompting(bloatware).

/system/vendor/app

If it's a system user app.

Alternatively an app can create it's own space in system where it has heaped binaries, libraries, frameworks and shell scripts used to initialize it's services in system.

A user can only be safe if he installs apps that the other user hasn't installed.

Improve this answer
3
  • App data is stored on a per-user base. With multi-user, each user has its own data directory. On internal storage this is done via mappings to the resp. "emulated storage" (which is mapped accordingly). Not sure how this is dealt with for the external SD card, though. An exception are OBB files, which are considered part of the app – so the logic for those might go with the logic for APKs.
    – Izzy ♦
    Dec 10, 2017 at 19:30
  • Yeah I have even used the directory to move photos and files from one user to another. And it works. Seems it's a mutual directory. I think multi-user is not well implemented in Android anyway
    – Thally Ace
    Dec 11, 2017 at 11:08
  • Yeah the OBB only
    – Thally Ace
    Dec 11, 2017 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .