Permission System: Only while using the app

adelina

What does it mean to enable "only while using the app"? For example, if I give location access to an app only while the app is in use. Does that mean the app can only access the location when the app is visible, or can the app also access my location when it is running in the background? How long can the app track me?

unwat

adelina
I read that if location is set to "only while using the app" the app can access the location only when it's visible (and up to 2 minutes after closing). After that, Android blocks all requests to location.

However, if an app is running all the time it can access location since it's running as a foreground service (any app that's listed under notifications).

If an app is running in the foreground and you want it stopped, pull down the notifications drawer twice. If there are any apps running foreground services, you'll see a circular icon in the lower right-hand corner with a number in it next to settings or profile switcher. Tap that and tap stop for any app you'd like.

adelina

Where did you find the information about app visibility after 2 minutes? Thanks for the information to remove apps from the foreground! I have an app there called "GmsCompat". I can not stop it. What is it? What does it? Why can't I stop it?

unwat

adelina
I read the two minute thing on a website for programmers. Android would give the app some buffer time to close correctly with regular permissions, but background locatiom access is for sure blocked according to Android documentation.

GmsCompat stands for Google Mobile Services Compatibility. It's the service that allows you to use Google Play and everything without it breaking on GrapheneOS. I always just swipe it away from my notifications drawer. You could also turn off the notification by tapping and holding your finger on the notification, tap the gear in the upper right-hand corner, find "sandboxed Google Play is running," and turn that notification off. Keep the other ones on because they're actually useful.

pinetree_raccoon

I have installed Google play services but in the "apps" app it shows gmscompat config as installed. do I need this, does it pose any additional security risk?

unwat

pinetree_raccoon
No security risk. They're both developed by GrapheneOS developers and like everything else on GOS, they're both open source and the code for both is here. GmsCompat is sandboxed just like any other app. It's a "system" level app, but it doesn't use crazy system privileges. The app just has privileges to do the following:

access location (precise, coarse, and background) - this assists Google Play in determining location IF you use Google Play Services for location
run as a foreground service (run all the time)
notifications

It doesn't have access to network.

GmsCompatConfig is basically just a text file. GrapheneOS developers use the config to make some changes to GmsCompat without needing to publish OS updates.