Android 10 open failed: EACCES (Permission denied)

Recently for one of the apps that I was working on, we changed the target SDK to API level 29 (Android 10). Ever since the change was made one of our workflows broke. The workflow is simple, we ask the user if they want to upload a logo to their profile. We let the user pick a file from their media gallery and upload this image to the server.

Running this workflow on an Android 10 device failed to upload the images. The error we saw was open failed: EACCES (Permission denied)

So, what changed?

According to the Android documentation.

Apps targeting Android 10 (API level 29) and higher are given scoped access into an external storage device, or scoped storage, by default. Such apps can see only their app-specific directory

Also in the documentation

In order to access any other file that another app has created, including files in a “downloads” directory, your app must use the Storage Access Framework, which allows the user to select a specific file.

Back to our workflow, when a user picks a file from the gallery, there is no guarantee that the file that was picked was added or edited by some other app. So, if the user picks on a file that let’s say belongs to another app we would run into the permission issues. So, how do we solve this?

There are a couple of ways to do this, in this article we will look into two ways.

Opt out of scoped storage

If your app is not ready for the changes that are coming in for Android 10 then you can “opt-out” by setting the flag requestLegacyExternalStorage to true in your manifest.

<manifest ... >
  <application android:requestLegacyExternalStorage="true" ... >
    ...
  </application>
</manifest>

I spoke to one of the developers from the Privacy team during the recent Android dev Summit and their recommendation was to use this solution as a temporary one

Using openFileDescriptor

The idea is to make a copy of the file that the user picks in the media gallery and add it to your application cache directory.

So, the first step is to open the file using openFileDescriptor

val parcelFileDescriptor = context.contentResolver.openFileDescriptor(fileUri, "r", null)

Let’s create an input stream from it.

val inputStream = FileInputStream(parcelFileDescriptor.fileDescriptor)

The next step is to get the file name from the URI, we can write an extension function on ContentResolver class for this. Please note that the logic below is inspired by the sample code from android docs.

fun ContentResolver.getFileName(fileUri: Uri): String {

    var name = ""
    val returnCursor = this.query(fileUri, null, null, null, null)
    if (returnCursor != null) {
        val nameIndex = returnCursor.getColumnIndex(OpenableColumns.DISPLAY_NAME)
        returnCursor.moveToFirst()
        name = returnCursor.getString(nameIndex)
        returnCursor.close()
    }

    return name
}

Alternatively, you can always give your own generated file name.

Now that we know how to get the file name, let's create a file in our application’s cache directory.

val file = File(context.cacheDir, getFileName(context.contentResolver, fileUri))

Now let us make OutputStream out of this file

val outputStream = FileOutputStream(file)

The final step is to copy the contents of the original file to our newly created file in our cache directory.

You can do this step in multiple ways, one easy way is to use the copy function from the IOUtils class(org.apache.commons.io.IOUtils).

IOUtils.copy(inputStream, outputStream)

Piecing it all together, the final code would be something like this.

val parcelFileDescriptor = context.contentResolver.openFileDescriptor(fileUri, "r", null)

parcelFileDescriptor?.let {
    val inputStream = FileInputStream(parcelFileDescriptor.fileDescriptor)
    val file = File(context.cacheDir, context.contentResolver.getFileName(fileUri))
    val outputStream = FileOutputStream(file)
    IOUtils.copy(inputStream, outputStream)
}

Now that your app has a copy of the file that needs to be uploaded, you can now safely upload this to your backend server.

presenter.uploadLogo(file, ....)

This should fix the permission issues you may face.

Let me know in the comments if this did or did not work for you or if you have other solutions I would love to hear them.

Thanks to Pranay for proofreading and giving me valuable technical feedback.