Request for Clarification/Confirmation Regarding Google Sandbox

IAmDarthMole

First I want to apologize for yet another Google Sandbox post. I have read several posts here, reddit, looked at the documentation on the GrapheneOS website and also watched several videos on youtube. Even after all that I still have some questions that I would be very thankful to have clarified/confirmed. Thank you in advance for your time.

1) Regardless of installation source (IE: F-Droid, Aurora, Google Play) GrapheneOS places each installed app into a sandbox with configurable permission controls?

2a) Regardless of permission controls, if user allows access between two apps, such as Signal to Contacts, or NextCloud to storage, then apps other then the original two could in theory access the shared data if they wanted to? This is simply the nature of the beast, or this case, Android and other OSes in general.

2b) Regardless of permission controls, if user allows access between two apps, such as Signal to Contacts, or NextCloud to storage, then apps other then the original two could in theory access the shared data and/or all data in either of the original two apps if they wanted to? This is simply the nature of the beast, or this case, Android and other OSes in general.

3) The situation/behavior described in 2a or 2b also applies to the three Sandboxed Google Play apps (Google Services Framework (GSF), Google Play services, Google Play Store), if you install Sandboxed Google Play on your phone, regarding looking into the exposed data?

4) If Sandboxed Google Play is installed in the main/only profile then the situation/behavior described in 2a or 2b could occur with one's data?

5) The question between "Main" Profile and "Second" Profile for installing Sanboxed Google Play comes down to whether you want the three Sandboxed Google Play apps having the option to snoop on the data that is being shared between, (and inside each of them?), the sharing apps? Whereas if a person wants to ensure that Google is limited to only the apps, and their data, that require google play services, they would use a separate profile?

I think that covers everything. Thank you again in advance for any help and your time.

de0u

IAmDarthMole Regardless of installation source (IE: F-Droid, Aurora, Google Play) GrapheneOS places each installed app into a sandbox with configurable permission controls?

Sort of. Every version of Android runs every non-system app inside some kind of sandbox. On each Android platform the app sandbox is largely automatic, i.e., not particularly configurable.

IAmDarthMole 2a) Regardless of permission controls, if user allows access between two apps, such as Signal to Contacts, or NextCloud to storage, then apps other then the original two could in theory access the shared data if they wanted to?

Not really. So far in Android there is no notion of "allow access between two apps". Every app in a user profile can communicate with every other app in that user profile via IPC (this is normal). No app can directly access the internal file storage of another app. In the future GrapheneOS may add controls on IPC within a profile.

IAmDarthMole This is simply the nature of the beast, or this case, Android and other OSes in general.

The permission models of various operating systems are key distinguishing factors among them. So it is probably not productive to lump them together. It would be sort of like discussing that Teslas need to be charged to go places, and then talking about "the nature of the beast, Teslas or automobiles in general". The Android permission model is not the same as the standard Linux permission model (the macOS permission model isn't the same either).

IAmDarthMole 2b) Regardless of permission controls, if user allows access between two apps, such as Signal to Contacts, or NextCloud to storage, then apps other then the original two could in theory access the shared data and/or all data in either of the original two apps if they wanted to?

Mostly no. There is no way for a user to "allow access" between the Signal app and the Contacts app. In Android, what Signal is or isn't allowed access to is a contacts database. That database is often displayed and edited via the Contacts app, but they're not the same thing. Likewise, "storage" isn't an app. And anything about "all data" is not how the Android app model works.

At this point maybe it's best if I stop to allow you to reformulate your question based on some of those clarifications.

IAmDarthMole

Hello again. I’m just going to bump this post once in case it slipped past anyone who may be able to answer due to the time of day I first posted. Thank you in advance for any clarification/assistance!

IAmDarthMole

de0u Thank you very much. I'm also rather embarrassed at how off I was in my understanding. Good thing I asked for clarification. I think it would be a good idea to go back to the drawing board with my research and try to get things figured out correctly before taking anymore of your time. Again, thank you so much for your reply and help!

de0u

IAmDarthMole The situation is pretty complicated. If you hang around for a while you will see similar questions asked. The GrapheneOS team has made some changes to the baseline AOSP permission model and has mentioned plans to make more changes. Meanwhile, Google makes changes. So it's not straightforward at any given moment.