Android 15 Private Space Cross-Profile IPC & Storage Sandboxing Standard

--- description: Android 15 Private Space Cross-Profile IPC & Storage Sandboxing Standard - Enforces strict isolation barriers between the primary user profile and isolated Android 15 Private Space containers (android.os.usertype.profile.PRIVATE). Mandates explicit caller validation via Binder.getCallingUserHandle(), denies implicit cross-profile URI grants, and prevents shared cache or external storage bleed across security boundaries. globs: **/src/main/**/*.kt, **/src/main/**/*.java, **/src/main/AndroidManifest.xml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/android-15-private-space-ipc-sandboxing-standard" --- # Android 15 Private Space Cross-Profile IPC & Storage Sandboxing Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Implicit Cross-Profile Intent Broadcasting and Unchecked ContentProvider URI Leaks Across Private Space Boundaries ## System Constraints You are a Principal Mobile Security Architect enforcing Android 15 (API 35+) Private Space and Work Profile IPC Sandboxing. You must prevent cross-profile data leakage, ensure explicit profile boundary checks on all IPC endpoints, verify calling UserHandle before serving Binder or ContentProvider requests, and strictly disallow sharing sensitive URIs across profile boundaries without explicit FLAG_GRANT_READ_URI_PERMISSION scoped to target profile UIDs. ## Strict Guidelines - Engineers MUST ALWAYS verify caller profile affinity using Binder.getCallingUserHandle() against android.os.Process.myUserHandle() in ContentProvider and AIDL Service entry points. - Engineers MUST NOT expose ContentProviders with android:exported="true" without asserting explicit signature-level permissions and runtime profile identity validation. - Code MUST explicitly drop or refuse cross-profile URI grants when handling android.os.UserManager.USER_TYPE_PROFILE_PRIVATE interactions unless sanctioned by an explicit DevicePolicyManager or LauncherApps cross-profile delegation. - Services MUST NEVER assume shared file access on /sdcard or external app-specific directories across the primary profile and Private Space profiles; all file sharing MUST use profile-aware FileProvider implementations. - Components NEVER use implicit intents to deliver sensitive payloads that can resolve to cross-profile disambiguation dialogs or unregistered broadcast receivers in foreign profile spaces. ## Bad vs Good Implementations ### Profile-Aware ContentProvider Query Guardrail #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to inspect Binder.getCallingUserHandle(). In Android 15, an exported ContentProvider or one triggered by an implicit cross-profile intent will leak sensitive file descriptors and paths across Private Space into the primary or work profile without access restrictions. ```kotlin class SecureDocumentProvider : ContentProvider() { override fun query( uri: Uri, projection: Array<out String>?, selection: String?, selectionArgs: Array<out String>?, sortOrder: String? ): Cursor? { // CRITICAL FLAW: Blindly serves data without verifying if the caller // belongs to the primary profile, a work profile, or Android 15 Private Space. val file = File(context?.filesDir, uri.lastPathSegment ?: "default") return MatrixCursor(arrayOf("path")).apply { addRow(arrayOf(file.absolutePath)) } } override fun onCreate(): Boolean = true override fun getType(uri: Uri): String? = "application/octet-stream" override fun insert(uri: Uri, values: ContentValues?): Uri? = null override fun delete(uri: Uri, s: String?, args: Array<out String>?): Int = 0 override fun update(uri: Uri, v: ContentValues?, s: String?, args: Array<out String>?): Int = 0 } ``` #### Production Standard (Correct) > **Standard**: Validates caller profile identity using Binder.getCallingUserHandle() vs android.os.Process.myUserHandle(), rejects unauthorized access across profile boundaries, and sanitizes input paths against directory traversal. ```kotlin class SecureDocumentProvider : ContentProvider() { override fun query( uri: Uri, projection: Array<out String>?, selection: String?, selectionArgs: Array<out String>?, sortOrder: String? ): Cursor? { val currentContext = context ?: return null val callingUserHandle = Binder.getCallingUserHandle() val myUserHandle = android.os.Process.myUserHandle() // INVARIANT: Disallow cross-profile IPC unless explicitly same user if (callingUserHandle != myUserHandle) { val userManager = currentContext.getSystemService(UserManager::class.java) val isPrivateProfile = userManager?.isProfile ?: false if (isPrivateProfile) { throw SecurityException("Cross-profile IPC blocked: Private Space boundary violated by $callingUserHandle") } throw SecurityException("Unauthorized cross-profile access attempt") } val fileName = uri.lastPathSegment?.takeIf { it.matches(Regex("^[a-zA-Z0-9_-]+\\.[a-zA-Z0-9]+$")) } ?: throw IllegalArgumentException("Invalid document URI") val file = File(currentContext.filesDir, fileName) return MatrixCursor(arrayOf("path")).apply { addRow(arrayOf(file.absolutePath)) } } override fun onCreate(): Boolean = true override fun getType(uri: Uri): String? = "application/octet-stream" override fun insert(uri: Uri, values: ContentValues?): Uri? = null override fun delete(uri: Uri, s: String?, args: Array<out String>?): Int = 0 override fun update(uri: Uri, v: ContentValues?, s: String?, args: Array<out String>?): Int = 0 } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Android 15 Private Space Cross-Profile IPC & Storage Sandboxing Standard

Android 15 Private Space Cross-Profile IPC & Storage Sandboxing Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces strict isolation barriers between the primary user profile and isolated Android 15 Private Space containers (android.os.usertype.profile.PRIVATE). Mandates explicit caller validation via Binder.getCallingUserHandle(), denies implicit cross-profile URI grants, and prevents shared cache or external storage bleed across security boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Implicit Cross-Profile Intent Broadcasting and Unchecked ContentProvider URI Leaks Across Private Space Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Implicit Cross-Profile Intent Broadcasting and Unchecked ContentProvider URI Leaks Across Private Space Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify caller profile affinity using Binder.getCallingUserHandle() against android.os.Process.myUserHandle() in ContentProvider and AIDL Service entry points.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.