I want to know if a system-app is able to read the data of other apps (the data stored in /data/data.) on Android 9.
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.Sign up to join this community
Yes! System Apps with the protection level signature (the System APK must be signed with the same key used to sign the ROM/Firmware), can read/write/execute/delete all data stored on /data/data or other folders on the device.
Note that third party apps (OEM custom apps) found on system/priv-app with protection level signatureOrSystem (Deprecated in Android 6.0). may not be able to do this unless they have signature protection level which means signed with the same key as the ROM/Firmware.
Examples: I've seen some chinese manufactures with their built-in data clone solutions which can make a backup to the whole APK and it's data in another phone, and IMO, this is a security risk which should not exist at all on android devices.
EDIT 1: As i've mentioned before let's take a look at an Android APK which is able to copy other APKs data/data folders, it's called Amiclone "com.gionee.dataghost" from the Chinese smartphone manufacturer Gionee (which BTW, faced bankruptcy and liquidation on 2018)
We have the following information, from version 2.1.0w_pub build 20100022
android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_MTK_MMHW android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_SUPERUSER android.permission.ACCESS_WIFI_STATE android.permission.BLUETOOTH android.permission.BLUETOOTH_ADMIN android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_STATE android.permission.GET_TASKS android.permission.INSTALL_PACKAGES android.permission.INTERNET android.permission.KILL_BACKGROUND_PROCESSES android.permission.MANAGE_DOCUMENTS android.permission.MODIFY_PHONE_STATE android.permission.MOUNT_FORMAT_FILESYSTEMS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.READ_CALENDAR android.permission.READ_CALL_LOG android.permission.READ_CONTACTS android.permission.READ_EXTERNAL_STORAGE android.permission.READ_LOGS android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECORD_AUDIO android.permission.UPDATE_APP_OPS_STATS android.permission.WAKE_LOCK android.permission.WRITE_CALENDAR android.permission.WRITE_CALL_LOG android.permission.WRITE_CONTACTS android.permission.WRITE_EXTERNAL_STORAGE android.permission.WRITE_MEDIA_STORAGE android.permission.WRITE_SECURE_SETTINGS android.permission.WRITE_SETTINGS android.permission.WRITE_SMS com.gionee.youju.statistics.permission.READ_PROVIDER com.gionee.youju.statistics.permission.WRITE_PROVIDER
Number of signers: 1 Signer #1 certificate DN: EMAILADDRESSfirstname.lastname@example.org, CN=Gionee, OU=Gionee, O=Gionee, L=ShenZhen, ST=GuangDong, C=CN Signer #1 certificate SHA-256 digest: c2d992c8a4cda2eed55f69357d6759937878e9a0f0b629524e88aa81ed65f802 Signer #1 certificate SHA-1 digest: 1bb8b4f46eafc2a06a46ba68fd8de543a5c65cbd Signer #1 certificate MD5 digest: b49792a5687b641492e10a29152f7454 Signer #1 key algorithm: RSA Signer #1 key size (bits): 2048 Signer #1 public key SHA-256 digest: 858b75200e11e0e62f6377b0b56beb728085823bddc31669d8348ee28b651815 Signer #1 public key SHA-1 digest: c780dfb20637a7cedcaf78298ec1bfcb7b069da1 Signer #1 public key MD5 digest: ceb817433cbe5a6a3c42cc7a562617ab
Also, this APK has a built-in busybox binary, and it's able to dump the whole user data from /data/data folders while transferring Apps from a Gionee device t o another.
Yes, a system APK can copy other Apps and their data, but it's not only about signature as @Irfan has pointed out in his comment, there are permissions of different levels (some of them require signature level protection) etc... But, as Android Enthusiasts replies are generally for end-users, the full details are not required to answer a question.