Access individual accounts without logging into 'owner' account first

vfqilvqvmc

I am trying to configure Graphene OS to allow a locked-down profile to be used without the Owner logging-in first.

On reboot I must login to the 'Owner' account before I can unlock any other accounts - this is bad for security because the Owner has special privileges (such as administration of other users), think of a situation where the owner wants to give a user a bio-metric accessed account which can be used (even after reboots / power-off) without the owner having to login to the device (they may not be present or accessible, so now the user is carrying a brick, and providing the user with the passcode for the Owner profile so they can login to their own defeats the security constraints... which is BAD!)

An ideal situation would be where (after a fresh reboot) I can provide biometric to the login screen (I don't have biometric on the Owner account), and it logs into whichever locked-down profile can be accessed by that fingerprint - or there is an authentication screen which requires the username to select the account to login to (I'm sure this was an option with earlier Android versions, but I can't find it on the latest GrapheneOS)

This would also enhance plausible deniability, essentially it's a 'Customs' unlock, "Yahs officarr, this device unlocks with my fingerprint, see"

Another interesting option would be allowing allow Guest logins after reboot (with a profile restored via a USB-OTG attached microSD card) without the Owner unlocking the device first (although that comes with its own security caveats as could be used to exploit the phone).

Interesting sidepoint: currently evaluating OnlyKey Duo with GrapheneOS for password login, but am unable to use it as FIDO2 provider for login in a way which the possessor of either devices cannot extract the login passwords. I can provide developers with a token amount of funding to purchase several OnlyKey devices for research purposes if that would help things...

unwat

vfqilvqvmc
From the website: https://grapheneos.org/faq#encryption

The owner profile is special and is used to store sensitive system-wide operating system data. This is why the owner profile needs to be logged in after a reboot before other user profiles can be used.

vfqilvqvmc

unwat

Yes, but in conjunction with a physical security device - like an OnlyKey or YubiKey, couldn't this second factor allow a 'partial unlock' which enables login to additional profiles without unlocking the Owner profile...

The problem is retaining device integrity, once the Owner profile is unlocked there is no device integrity....

This is the main thing we're looking for with MDM, physical two-factor with restricted user profiles and bio-metric authentication, where even with access to the 2nd-factor device and the phone it's impossible to unlock the Admin profile to manage the device.

unwat

vfqilvqvmc
Using a physical security device doesn't change the fact that owner needs to be logged in first. Network, carrier, filesystem encryption, etc. settings/data have to be stored somewhere, and they're stored in Owner. If owner isn't logged in, the filesystem cannot be read since it's still encrypted. I believe that's how AOSP is set up too.

Why wouldn't you just have the users use the owner profile and lock down some settings down with MDM? Only the owner profile can set some global settings so you'd probably want to have the owner profile provisioned anyway, which of course means it would have to be active to pull policy down and apply it. Based on what you've said about multiple users, I'd definitely want owner provisioned and active for a remote wipe if the worst were to happen to the phone.

I'm also not sure MDM provisioning would work for a secondary profile. That's something you'd have to test with whichever management software you're using. I've read in a few places that it never works or doesn't work sometimes for secondary user profiles.

I've never heard of any Android devices that use multi-factor authentication the way you're describing. Is that really something that other phones support? GrapheneOS doesn't even support multi-factor authentication utilizing phone hardware, but I've read people asking for it. I've read multiple devs say that with brute force throttling a 6 digit PIN is more than sufficient (not in the same context, to be clear). If profiles can be provisioned, couldn't you just enforce a complex password?

And, last thing, GrapheneOS tries hard not to stray too far from AOSP like other OSs. If the features you're requesting are included in AOSP, they'll be in GrapheneOS.