How to fix file permissions on Android 5 so that a certain app can access certain files?

Question

Background: I had a rooted Nexus 4 with Android 4.4.4 that was working well. Then I got the notification to update to Android 5. To this end, I flashed the stock recovery for Android 4.4.4 from Google and started the upgrade (but I did not unroot the phone, maybe this was a mistake). The upgrade process itself went smoothly. After the upgrade, I re-flashed TWRP 2.8.2 and re-rooted with SuperSU 2.36, and made a backup.

Then, I realised that some data (photos, E-Books, …) were missing. Well, not actually missing, but located under a spurious "0" directory (/storage/emulated/0/0). Additionally, when I attempted to access my E-Book-Folder directly with FBReader, it told me there were insufficient permissions to access the directory.

First, I tried the "Fix Permissions" button in TWRP, but that put me in a boot loop. After restoring the backup, I used the TWRP file manager to move all data from the spurious "0" directory to where they belong and deleted the now empty "0" directory. Rebooting once again brought up the "Optimizing apps" screen, but only for 7 apps. Now I can access my E-Books again, but still no (old) photos in the Google photos app. Photographs taken after the backup show up fine. With the file manager or the terminal, I can access all photos just fine once I call setenforce 0. The permissions shown by ls -Z /storage/emulated/0/DCIM/Camera look alike on all photos, both visible and invisible in the photos app: -rw-rw---- root sdcard_r u:object_r:fuse:s0. So my guess is that there is some additional SELinux permission I have to set on the older image files so the photo app can access them. Therefore my question is: what permission concepts are at work here, and what commands are necessary to assign files/directories to a certain app? Thanks.

Update: I just found out I can take new pictures only with setenforce 0, so there has to be some major SELinux breakage somewhere.

Answer 1

Try using Supersu 2.49 beta for Lollipop (LP) 5.0.

Do a full unroot first.

I have LP 5.0 Touchwiz on my Samsung tab with SElinux enforcing and functioning root. The Supersu version in your recovery can probably be replaced by unpacking your recovery with any number of methods and/or tool-sets, and replacing the archive. The better approach would be to update your recovery if one is available. Also, fix permissions scripts need a different/new approach as of Android 5.0.

This is my imperfect fix permissions script for my other Samsung tab running LP 5.1.1:

#!/system/bin/sh
mount -o rw,remount /system
find -type d -exec chmod 755 {} \;
find -type d -name '.*' -exec chmod 755 {} \;
find -type f -name '.*' -exec chmod 644 {} \;
find -type f -name '.su' -exec chmod 755 {} \;
find -type f -exec chmod 755 {} \;
find -type f -name '*.h' -exec chmod 644 {} \;
find -type f -name '*.a' -exec chmod 644 {} \;
find -type f -name '*.o' -exec chmod 644 {} \;
find -type f -name '*.so' -exec chmod 644 {} \;
find -type f -name '*.so.*' -exec chmod 644 {} \;
find -type f -name '*.c' -exec chmod 644 {} \;
find -type f -name '*.cpp' -exec chmod 644 {} \;
find -type f -name '*.cgf' -exec chmod 644 {} \;
find -type f -name '*.xml' -exec chmod 644 {} \;