2

Fonts in Android are kept in /system/font directory. There seems to be no way to install custom fonts without rooting your Android or installing some apps.

  • Why has Google made it almost impossible for Android users to install custom fonts?
  • What was the engineering decision that led fonts not getting picked up from ~/.fonts/ user directory as happens in a standard Linux Distribution?

The same behaviour is seen in ChromeOS as well.

8
  • 2
    1. the system partition is never writable, that is a common standard on embedded devices. 2. Android is not a common Linux system, that means there is no user and thus no home directory...
    – Robert
    Jun 15, 2022 at 8:59
  • @Robert 2. You're partially wrong. Android is a non GNU/Linux system I agree but home directories indeed exist in Android: They're /storage/emulated/0 , /storage/emulated/1 and so on Jun 15, 2022 at 17:08
  • @karthiknair Are you sure that /storage/emulated/0 is the home directory? And of which user? Every app has an own user account, so it would not make sense to have one home directory for all users. On Android versions prior to 11 /storage/emulated/0 was often used like a home directory by some apps, but it was never a home directory in a Linux meaning. And since Android 11 it isn't accessible at all on file level.
    – Robert
    Jun 15, 2022 at 17:14
  • @Robert /storage/emulated/0 is what you see when you open File Manager and tap on 'internal storage' i.e where folders such as Downloads, Pictures, Android etc exists just like in a Linux system. /storage/emulated/0 is for user 0. if you create another user and open internal storage in file manager, the contents you see are under /storage/emulated/1 Jun 15, 2022 at 17:27
  • @Robert In android >=11, /storage/emulated/0/Android isnt accessible at all in the file level (there are workarounds for that too). But /storage/emulated/0 has always been and would continue to be accessible Jun 15, 2022 at 17:29

1 Answer 1

7

Fonts can be considered an attack surface so system level fonts are restricted.

The Android Open Source Project documentation has a section on Custom Fonts Fallback which allows for Android 12+ OEMs to modify/update the system font with appropriate system level permission/keys. For Android 11 and earlier, the system font was delivered with a ROM update.

Reading on there is a section on signing font files:

Signing font files

Since font files are risky resources, they must be verified with trusted keys. Carefully review all font files that are to be updated, and sign with your private key. The signature must be fs-verity compatible.

where Google calls out that font files are 'risky resources'.

Quoting from: How can a font be used for privilege escalation?

Fonts are hard. It's old code. It runs in kernel mode.

Related post: How to detect suspicious content in a TrueType Font (.ttf) font file

So it can be implied that by not allowing end-user customization of the system fonts, there is a reduction of the attack surface.

Individual apps can embed their own custom font files for use within their own app.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .