7

According to this, every application in Android runs as a separate kernel-level user, with a unique user ID and group ID.

So, what happens under the hood when you add a new user (e.g. to your shared tablet)?

  • 3
    If I recall this each task is a application is run as a seperate 'user' in the kernel, under the overall user that has logged in. That means that there are many 'USERS' as in real people with accounts, but the kernel level stuff is a virtual user, not a real person or user of the tablet/device, but an abstract isolated process. It is a security/privacy concern. Adding another human user profile just adds another layer of this. You will be user1 with lots of applications running under virtual 'users', and user2 will have their apps running under virtual users. The word 'user' is confusing. – RossC Jan 27 '14 at 12:52
  • Don't mix up "OS users" with User Profiles / Accounts. The "Multi-User" feature added with JellyBean uses Profiles for different Accounts, not OS-Users. Two completely different pairs of shoes. – Izzy Jan 27 '14 at 13:05
17

The Linux user IDs that Android uses to isolate apps from each other are completely unrelated to user profiles on Android 4.2 tablets.

In Android, each app gets its own directory for saving data. The Linux user ID system is used to make sure apps can't read each others' data. But all these data directories are inside one directory on the filesystem, /data/user/0. Let's say the first user is called Abulurd, and he installs the app Showr. It might be given user ID 1004, and the directory /data/user/0/com.shadowburst.showr.

Now, let's say you create a new user profile for Beatrice. She gets a fresh directory, /data/user/1, which starts off empty. When she logs into the device, and installs Showr, it doesn't download the app again (because the Android app installer knows the APK file is already on the device), but it does create a new user ID 1007 (for example), and a new directory /data/user/1/com.shadowburst.showr.

Android uses Linux filesystem permissions, and the different Linux user IDs, not only to make sure that Abulurd's Showr can't read the data of Abulurd's other apps, but also that Abulurd's Showr can't read the data of Beatrice's Showr. The two instances of Showr run in different processes, with different user IDs.

If you're familiar with Linux terminology, making a new user profile is similar to using chroot on the device to get an isolated part of the filesystem to run apps in.

What I've described is the usual process, but just as apps can be written to share a data directory with other apps by the same developer (signed with the same key), Android gives apps the opportunity to say they work with multiple users. This way, an app can be written to have one process for all the user profiles, to let them share data or perform some special function. The lock screen has to work this way, for instance, because all user profiles share one lock screen app, which has to read all users' lock-screen settings.

| improve this answer | |
  • Parallel post :) To put it into easier terms, can the profiles be compared to running different VMs on the same host, using a kind of "shared storage"? – Izzy Jan 27 '14 at 13:17
  • No. A VM would have its own kernel. – Dan Hulme Jan 27 '14 at 14:01
  • So if a person installs an application and it is assigned to the user id e.g. app_143, and later creates another user profile and reruns the application with that user profile active at some point, another user id e.g. app_265 may be created for the same application? – 43488 Jan 27 '14 at 18:00
  • @galegosimpatico Yes, that's exactly it. Don't forget that the application has to be installed for the new user profile before it can run. – Dan Hulme Jan 27 '14 at 18:07
  • Thanks. You say that it doesn't download apps twice because the installer knows the APK file is already on the device. Well, it doesn't download it, but does it reinstall the app (on demand of another profile)? Can't some "binaries" be shared between all users? (for reinstalls of really heavy or big applications) – Reflection Jan 27 '14 at 21:48
2

What happens when you add a new user account is that a new account (or "User Profile") is created. This has nothing at all to do with the user/group management on OS-Level. You will notice that most how-tos (e.g. this one on HowToGeek) speak about accounts, as the term "user" would be rather misleading.

I'm not an Android dev, so I cannot give you a deeper technical explanation. But as far as I know, the multi-user feature is realized on-top of the Linux core (i.e. in Java/Dalvik). EDIT: Dan posted his answer at the same time as I mine, so see there for the technical background :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.