OEM unlocking: Which apps/services are responsible?

ungraph

The OEM unlocking toggle of a new Pixel 6a is greyed out, since it has not been connected to the internet yet.
I do understand that an internet connection needs to be established to enable a IMEI/serial check against a database to determine whether a device is subject to carrier restrictions etc.
However, once the internet connection is established all kinds of Google Services and Apps will be using that opportunity to transfer data, download updates and so forth.
I would like to avoid that by using a firewall to block all apps and exempt only those apps or services that are needed to perform the IMEI/serial check.

So my question is the following:
Which apps/services/domains/IPs will I have to grant internet access to in order to allow the IMEI/serial check and thereby enable the currently deactivated OEM unlocking?

Surprisingly I could not find anything on that topic in this forum or elsewhere on the web.
If it has been discussed somewhere, please refer me to that.

Thank you!

boldsuck

ungraph Please note that you should upgrade the 6a first because of a bug not allowing you to enable OEM unlocking. https://discuss.grapheneos.org/d/12689-android-14-required

akc3n

ungraph Surprisingly I could not find anything on that topic in this forum or elsewhere on the web.

In addition to:

collector Also if the device is brand new, there isn't really any data to transfer

Perhaps your best course of action would be to read through the information and locate relevant data on the links provided in the welcome dialog during the initial setup wizard on a new device, when agreeing to use the phone.

See example screenshot of what the titles to the linked terms and policies end users agree too.

collector

If I were to guess it would be part of either play services or carrier services. But I recommend that if you don't want google to know your home location, you can probably just go to a nearby coffee shop or somewhere with public wifi, connect to their WiFi and once unlocked, factory reset your phone or just flash GOS

Dumdum

ungraph Sad to see that no one was able to answer my question :-(

Literal first response was this:

collector If I were to guess it would be part of either play services or carrier services. But I recommend that if you don't want google to know your home location, you can probably just go to a nearby coffee shop or somewhere with public wifi, connect to their WiFi and once unlocked, factory reset your phone or just flash GOS

But ok.

collector

As for google downloading stuff, it shouldnt matter in the long run since you are flashing a new OS and it should wipe everything. Also if the device is brand new, there isn't really any data to transfer 🫤 maybe your IEMI but that's needed anyways

Dumdum

ungraph
It did answer your question. They said it was a google services thing. You confirmed that, as far as I can tell, by stating that RethinkDNS was blocking a number of google connections. Ergo, it seemed to be a google services thing (or something Google-related anyhow).

Would you be happy with a reply in the sense of: "If I were to guess the cause it could be somewhere in the engine compartment. But I recommend that if you don't want to deal with that issue any further you just walk or simply buy a new car"?

Bad comparison. This suggests that you shouldn't bother using the car at all. Collector did no such thing. They merely gave fair advice how to use the device while also achieving the goal of not disclosing your location. Quite the opposite of what you're suggesting.

Your comparison also (conveniently) removes the very important part of what the issue the car is having. For example, the car could have a known flaw (much like the known flaw of the Pixel 6a, which was in fact mentioned by boldsuck and also conveniently ignored) in its engine that may, for example, pose a risk in some way to the car's owner, in which case the answer to the question "would I be happy with a reply..." would be a resounding "yes, yes I would". After all, the person giving me the reply is giving me fair and considerate advice that I can choose to make use of or not. But I certainly wouldn't ignore the advice and pretend no one helped me.

Besides, it seems this is resolved now? Might as well get it tagged and leave it at that. @matchboxbananasynergy

Edit: Oh, looks like @other8026 has appeared, sorry Matchbox.

ungraph

Sad to see that no one was able to answer my question :-(

Thankfully I was able to determine the culprit myself: It is the Google app!
Once I granted it internet access in the RethinkDNS firewall - while every other app was being blocked - the OEM unlocking was immediately possible!

The Google app connected to the following domains:
afwprovisioning-pa.googleapis.com
auditrecording-pa.googleapis.com
remoteprovisioning.googleapis.com
gmscompliance-pa.googleapis.com
www.google.com
android.googleapis.com
Mostly in the IP ranges 142.250.18x.y and 172.217.1x.y.

With the next pixel device I can hopefully examine further if a more fine-grained permission/blocking is possible to determine which of these domains or IPs exactly need to be allowed.

ungraph

Dumdum
Yes and the response did not answer my question. I was not asking for guesses or speculations.
Imagine having an issue with a car engine and asking for help at an auto shop. Would you be happy with a reply in the sense of: "If I were to guess the cause it could be somewhere in the engine compartment. But I recommend that if you don't want to deal with that issue any further you just walk or simply buy a new car"? Well, I would not be.
But ok.

other8026

ungraph phones aren't cars and usually mechanics have a better idea of what's going on inside a car than we do about what's going on in Google's proprietary OS and their apps.

As far as I know, unlocking the bootloader of a phone that's been locked by Google or the carrier is not possible anymore. GrapheneOS users haven't hacked their Pixels, they bought them unlocked and many didn't even bother to look into how all this works like you have. I personally don't see why it's "sad" that "no one was able to answer your question."

But I actually have probably 2-3 years ago, so things might be different now. You could check if the app com.google.android.apps.work.oobconfig is still being used (back then it was one of the only apps with the permissions to change OEM lock stuff) and I vaguely remember the remote provisioning site was the one I suspected of being where all that is done, but then again all of the addresses you listed upthread look familiar so I could be remembering wrong.

Regardless, it says right on the GrapheneOS website and we all say very plainly that the phone phones home to see if it can be unlocked. I understand that it's annoying, but that's just the reality.

de0u

ungraph Imagine having an issue with a car engine and asking for help at an auto shop. Would you be happy with a reply in the sense of: "If I were to guess the cause it could be somewhere in the engine compartment. But I recommend that if you don't want to deal with that issue any further you just walk or simply buy a new car"?

The phone is working exactly as it is documented as working.

I suspect that if I took my car to my mechanic and said "This car is working exactly the way the owner's manual says, but I want to know which chip stores the tick-tock sound that the turn signal makes" then my mechanic would say "I don't know... that sound is probably stored somewhere under the hood or somewhere inside the dashboard".