Do Google Play Services really have all these permissions?

ryrona

On the GrapheneOS page it says that Google Play and Google Play Services receives absolutely no special permissions. I have also only given them both Network permissions and nothing else in the app settings. But if I go into Settings -> Apps -> Google Play Services -> All services it says it has permissions to read SMS messages, use the camera, open all media files stored on my phone, and much more. Does it have these permissions, or is this settings card provided by Google Play Services itself and it only thinks it has those permissions but actually doesn't?

Titan_M2

ryrona Just needs network permission for basic functionality

it says it has permissions to read SMS messages, use the camera, open all media files stored on my phone, and much more.

Post a screenshot of these

fid02

ryrona is this settings card provided by Google Play Services itself

Yes, it is. I checked just now on stock PixelOS. It's a page provided by the app and not GrapheneOS.

ryrona But if I go into Settings -> Apps -> Google Play Services -> All services it says it has permissions to read SMS messages, use the camera, open all media files stored on my phone, and much more.

What I'm seeing is a settings page with more information about specific services included with Play Services, as well as options to enable or disable features of these. I'm not seeing any text saying that it has permission to do X, Y, Z. Maybe I'm overlooking something?

In any way, the app has to play by the same rules as any other app that is running in the Android app sandbox, which includes being forced to respect the permissions you grant or do not grant to it – if you don't grant it the SMS permission, it does not have the SMS permission. And so on.

ryrona

Titan_M2 I don't seem to be able to attach images, but just go into Settings -> Apps -> Google Play services -> All services -> Account management for example, and it will say:

Only those services that you turn off will be disabled. Some services must remain active for your device to function as intended.

This service uses these permissions: Call logs, Camera, Contacts, Nearby devices, Phone, Photos and videos and SMS

Similar for all the other services that seem to be installed as part of the Google Play services package. I also cannot edit the permissions there, like they are mandatory.

Dumdum

ryrona
Yes, these services use those permissions. This does not necessarily mean it has those permissions.

ryrona

Dumdum Okay, so just to be clear so there isn't any misunderstanding. No service that is part of Google Play services app has access to any other permission than the ones I have granted to the Google Play services app? So if I have only granted Network permission, no service listed on that page have access to my photos or text messages or anything else than the network?

Each of those services are completely sandboxed with the permissions granted to the Google Play services app?

Dumdum

ryrona
Yes.

ryrona

Dumdum Okay, thank you for the clarification!

ryrona

fid02 Yes, it is. I checked just now on stock PixelOS. It's a page provided by the app and not GrapheneOS.

Okay, then it was like I suspected, and also why it claims it has or use those permissions, because it would on regular Android I guess, since Google Play services is a non-sandboxed system service there. I just disregard that page then as not applicable for GrapheneOS.

fid02 In any way, the app has to play by the same rules as any other app that is running in the Android app sandbox, which includes being forced to respect the permissions you grant or do not grant to it – if you don't grant it the SMS permission, it does not have the SMS permission. And so on.

Thank you for the clarification!

[deleted]

Certain permissions may be granted on install, that user can't revoke or doesn't even get notified.
https://developer.android.com/guide/topics/permissions/overview#install-time

fid02

[deleted] Would you mind elaborating on how this relates to Sandboxed Google Play specifically?

ryrona

[deleted] Certain permissions may be granted on install, that user can't revoke or doesn't even get notified.

Yeah, I was mostly concerned about the permissions with privacy implications, like access to files or camera or text messages or so, and I think those are all user controlled, and according to the above answer by @Dumdum and @fid02 this is also true for all services that are part of Google Play services.

[deleted]

fid02 if I had such insight, I would have already mentioned it in my previous post. But I would like to call upon those who work with Android on development level to enlighten us on this issue, especially when it comes to sandboxed Google Play Services. I am sure it will be very appreciated.