[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-27 (世界標準時間)。"],[],[],null,["# Scoped storage limits app access to external storage. In Android\n11 or higher, apps targeting API 30 or higher must use\nscoped storage. Previously in Android 10, apps could opt out of scoped storage.\n\nApp access restrictions\n-----------------------\n\nThe goal of scoped storage is to protect the privacy of app and user data. This\nincludes protecting user information (such as photo metadata), preventing apps\nfrom modifying or deleting user files without explicit permission, and\nprotecting sensitive user documents downloaded to Download or other folders.\n\nApps using scoped storage can have the following levels of access (actual access\nis implementation specific).\n\n- **Read** and **write** access to their own files with no permissions\n- **Read** access to other apps' media files with `READ_EXTERNAL_STORAGE` permission\n- **Write** access to other apps' media files is allowed only with direct user consent (exceptions granted to System Gallery and apps that are eligible for All Files access)\n- No **read** or **write** access to other apps' external app data directories\n\nUse scoped storage with FUSE\n----------------------------\n\nAndroid 11 or higher supports Filesystem in Userspace\n(FUSE), which enables the MediaProvider module to examine file operations in\nuser space and to gate access to files based on the policy to *allow* , *deny* ,\nor *redact* access. Apps in scoped storage that use FUSE get the privacy\nfeatures of scoped storage and the ability to access files using a direct file\npath (keeping File APIs working in apps).\n\nAndroid 10 enforced scoped storage rules on file accesses by MediaProvider, but\nnot for direct file path access (for example, using File API and NDK APIs) due\nto the effort required in intercepting kernel calls. As a result, apps in scoped\nstorage couldn't access files using a direct file path. This restriction\nimpacted app developers' ability to adapt as it required substantial code\nchanges to rewrite File API access to the MediaProvider API.\n\n### FUSE and SDCardFS\n\nAndroid 11 support for FUSE is unrelated to the\n[deprecation of SDCardFS](/docs/core/storage/sdcardfs-deprecate), but does\nprovide an alternative to Media Store for devices that previously used SDCardFS.\nDevices:\n\n- Launching with Android 11 or higher using kernel 5.4 or higher can't use SDCardFS.\n- Upgrading to Android 11 or higher can host FUSE on top of SDCardFS to intercept the file operations and meet privacy goals.\n\n### FUSE performance tuning\n\nAndroid previously supported FUSE in Android 7 or lower, in which external\nstorage was mounted as FUSE. Due to performance and deadlock issues with that\nFUSE implementation, Android 8 introduced SDCardFS. Android\n11 reintroduces support for FUSE using an improved,\nbetter-tested implementation of `libfuse` that can be tuned to resolve the\nperformance issues in Android 7 or lower.\n\nFUSE tuning includes the following tweaks:\n\n- Bypassing FUSE for the `Android/data` and `Android/obb` directories to improve performance for game apps that rely on these directories.\n- Optimizations (such as tuning the read-ahead and dirty ratios of the FUSE file system) to keep reads performant and media playback smooth.\n- Using the FUSE write-back cache.\n- Caching permissions to reduce IPCs to the system server.\n- Optimizations for apps with All Files access to make bulk operations faster.\n\nThe above tuning tweaks can produce comparable performance between FUSE and\nnon-FUSE devices. For example, testing a tuned Pixel 2 using FUSE and a Pixel 2\nusing Media Store found comparable sequential read performance (for example,\nvideo playback) between file path access and Media Store. However, sequential\nwrites were slightly worse with FUSE, and random reads and writes could be up to\ntwice as slow.\n\nPerformance measurements can change from device to device and between specific\nuse cases. Because MediaProvider APIs give the most consistent performance, app\ndevelopers that are concerned about performance should use MediaProvider APIs\nfor their apps.\n\n### Mitigate FUSE performance impact\n\nFUSE performance impact is limited to heavy users of files stored on external\n*shared* storage only. External *private* storage (which includes `android/data`\nand `android/obb` directories) is bypassed by FUSE, while internal storage (such\nas `/data/data`, where many apps store data to keep it encrypted and secure)\nisn't FUSE mounted.\n\n- Apps that are light users of shared external storage often interact with a\n limited set of files (typically fewer than 100 files). These apps benefit from\n existing optimizations of common read and write operations and shouldn't see\n any FUSE-related performance impact in Android 11.\n\n- Apps that are heavy users of shared external storage typically perform bulk\n file operations, such as listing or removing a directory with a 1000 files, or\n creating or deleting a directory with a million files on the file system. Bulk\n file operations might be impacted by FUSE on Android 11, but if such apps are\n eligible for the `MANAGE_EXTERNAL_STORAGE` permission, they benefit from the\n performance optimizations included in the October 2020 update.\n\n| **Note:** When bulk operations involve large files such as images and videos, file I/O might have a greater impact on file operation performance than the FUSE performance overhead.\n\nTo avoid FUSE performance overhead, apps can store data in external private\nstorage or use bulk APIs in the `ContentProvider` class to bypass FUSE and get a\nperformance-optimized path. In addition, the October 2020 update to the\nMediaProvider system component includes performance optimizations for file\nmanagers and similar apps (such as backup/restore, antivirus) that hold the\n`MANAGE_EXTERNAL_STORAGE` permission.\n\n### Privacy over performance\n\nOn devices that have been tuned for FUSE, most critical user journeys are\nequally performant between Android 10 and Android 11.\nHowever, when testing benchmarks over a set of file operations, Android\n11 might perform worse than Android 10. For file access\npatterns that perform worse in Android 11 (for example,\nrandom reads or writes), we recommend using MediaProvider APIs to give apps a\nnon-FUSE access mode, which is the best and consistently performant option.\n| **Note:** While Android is committed to resolving performance regressions that affect user journeys, we strongly believe that the privacy benefits of scoped storage in protecting sensitive user data outweigh performance penalties.\n\nMediaProvider and FUSE updates\n------------------------------\n\nThe [MediaProvider](/docs/core/media/media-provider) system component\nbehavior differs between Android releases.\n\n- In Android 10 and lower, SDCardFS was the file system and MediaProvider\n provided an interface to collections of files (for example, images, videos,\n music files, etc.). When an app created a file using File API, it could ask\n MediaProvider to scan the file and record it in the database.\n\n- In Android 11 or higher,\n [SDCardFS](/docs/core/storage/sdcardfs-deprecate) is deprecated and\n MediaProvider becomes the file system handler (for FUSE) for external storage,\n making the file system on external storage and the MediaProvider database\n consistent. As the userspace handler for the FUSE file system, MediaProvider\n can intercept kernel calls and ensure the file operations are privacy safe.\n\nIn Android 11 and higher, MediaProvider is also a\n[modular system component](/docs/core/architecture/modular-system) (a\nMainline module) that can be updated outside of Android releases. This means\nthat performance, privacy, or security issues found in MediaProvider can be\nfixed and delivered over the air from the Google Play Store or other\npartner-provided mechanisms. Anything in the scope of what's expected from a\nFUSE handler is also updatable, enabling updates to fix FUSE performance\nregressions and bugs."]]
