Sensors and Network permissions

Clark

Hello. I am brand new to GOS and installed it just today. I scrolled through the different permissions and noticed Google Framework Services use a lot of unfamiliar applications to get access to my location and network. Some of these include “3 Button Navigation Bar” “Android Easter Egg” “Android Shared Library” “Android System Angle.” In Networks I am seeing url-like names like “com.android.federatedcom[…]” “com.android.sdksandbox” “DeviceLockController.”

This has me very worried. I don't know what any of this means. I have removed almost all permissions from all apps but maybe this will make my device crash? What should I do? Is this safe or should I uninstall Google Services and rely on Aurora instead?

Many thanks.

Dumdum

Clark I have removed almost all permissions from all apps but maybe this will make my device crash?

It has the potential to cause issues, so yes, removing permissions from system apps are not recommended.

Edit: Assuming you've touched the system apps that is.

de0u

Clark I don't know what any of this means.

There is a lot of material on the GrapheneOS web site about what things mean and how to use them. With respect to the Network permission, see: https://grapheneos.org/features#network-permission-toggle (which explains why the permission is granted to lots of applications by default).

Clark I have removed almost all permissions from all apps but maybe this will make my device crash?

This is likely to create weird problems that will show up over weeks or months, each one of which will be difficult to diagnose. If you just installed GrapheneOS today, and immediately removed a bunch of permissions from a bunch of system apps, honestly it might be best to factory-reset the device today and start over with a clean slate -- it might save you lots of time later.

By running GrapheneOS, and especially by placing data you care on a device that is running GrapheneOS, you are inherently placing trust in thousands of decisions that the GrapheneOS developers have made over multiple years. Removing permissions from apps that were chosen by the GrapheneOS developers is unlikely to be productive, and is likely to be counterproductive... and meanwhile will not address the acres of non-app code that the GrapheneOS developers also chose (kernel code, system frameworks, etc.).

I'm not suggesting that you must make a leap of faith and 100% trust the GrapheneOS developers without any recourse. The source code is available, so it is possible to see what is happening. If something is wrong, it's possible to build your own copy of GrapheneOS and fix it, and/or submit a fix to the project. This is not a "take it or leave it" system. But it is also not a system that is improved by disabling parts of it without first acquiring deep understanding.

Please note that I do not speak for the GrapheneOS project.

Clark

Dumdum Just to be clear, system apps don't include Google Services?

Dumdum

Clark
Those apps you described (such as 3 button navigation bar) only show in the list after tapping "show system", so those are system apps.
However, as you can see Google Play services / Store / Framework show up without tapping "show system".
That's because GOS restricts them into the standard Android app sandbox, so they behave as regular user apps and not privileged system apps.

You can change the permissions of the three Google apps (services/store/framework) however you wish. The minimum you need for Google Play to work is the Network permission. System apps, however, should not have permissions changed in case issues occur.

matchboxbananasynergy

None of the mentioned apps make connections to Google. GrapheneOS by default makes no connections to Google.

I highly recommend undoing everything you did and not touching the permissions of system apps.

The app names you're seeing are not links, that's just the covnention of app names for Java (referring to the com.name.name convention).

Our FAQ details what the default connections of GrapheneOS are:

https://grapheneos.org/faq#default-connections

Google Play Services are only installed optionally, if you manually install them yourself, and as @Dumdum explained above, on GrpaheneOS they're sandboxed just like any other app you'd install, they don't have system privileges.