Best way to update apps throughout user profiles

ticklemyIP

As I understand, in leymans terms, if an app is installed in multiple user profiles, all of those app instances are updated when one of the profiles updates the app. Because those programs are actually not separate, but they are just different instances. A user profile that does not include an app "instance" cannot update that app throughout user profiles without first installing it, and apps like F-droid would not be able to see those apps to update them.

Is there a way to update all of the installed apps on the device without going through all of the user profiles and manually refreshing, then updating through whatever source the particular app uses? Even if some apps in these profiles overlap, and updating it in one user profile would update it in the other too, some may only be present in one profile and not the other which would require multiple App stores.

I have been thinking what would be the best way to provision apps at once through user profiles? The admin profile has the ability to install apps to user profiles, but user profiles do not have this ability. Would installing all the apps inside the admin profile at once work?

It could allow to distribute installed apps to profile that need it via the settings menu and update all of those apps all at once, without having separate instances of App stores in every profile.

The issue I have with this approach is, wouldn't this method increase attack surface, especially if I installed Play services in the admin profile? Because even though I wouldn't use any of those apps in the admin profile, they don't have Network permissions, they are all piled inside, which should increase attack surface right?

If I were to do this in a regular user profile I would lose the ability to install these apps inside other profiles from the current profile which would require a second app store to install necessary apps, then delete that app store.

What do you think? Am I approaching this from the right angle?

Would it be easier and more practical to just update them on a case by case basis from their respective user profiles?

Dumdum

ticklemyIP
You can disable apps you aren't using in the Owner profile. I think this solves the attack surface issue as it shouldn't be possible for any of the app's code to run.

N1b

You're on the right track. I have such a setup:

Owner profile: Appstores installed (Play Store, Droid-ify, Aurora Store for Discord), all other non-system apps have revoked all permissions, not allowed battery background usage and then been disabled. Probably overkill, but they have never been opened and lay dormant in the owner profile.
User profiles: Have the respective apps pushed by the owner profile, so no app stores necessary in user profiles. They are sandboxed by GrapheneOS and separated through profiles.

The phone reboots at night (auto reboot set to lower value than my sleep time), so in the morning I unlock the owner profile and check for updates, then go to the user profile.

The attack surface for your security is already very low by simply using the most secure mobile OS with all its hardening. Your privacy attack surface is also low because apps are compartmentalized and never active in the owner profile. And even if they were active, they don't have the network permission to send data. And even if they were circumventing that, there's no user data in the owner profile, just the app list. I don't worry at all about security and privacy on the OS level, but my threat model doesn't include me being on a 3 letter agency list either... (and I'm still using f*cking Discord, so my privacy concerns lie elsewhere :D).

user539

N1b so in the morning I unlock the owner profile and check for updates

So you are saying that play store can update disabled apps? Or am i missing something.

greetdnashoe

N1b This is interesting...

Clarifying question, though!

How do apps from these get installed on the user profile, if you only have app stores on the owner profile?

Or do you have the app stores AND the apps you need from the app stores on your owner profile and push those apps to the user profile?

Chefsnade

N1b sorry, just to clarify and rather than starting a new thread.....
Disabling the app revokes all permissions, on top of that you need switch off 'allow background usage' for the battery. But what about WiFi date 'background data' this off also?
ATB

yellow-leaves

user539 That's correct, all app stores can update disabled apps on GrapheneOS.

missing-root

Can someone explain why I would want to use user profiles?

My 6a is already not thaat fast. I separate apps with work profile and private space. This allows me to share files easily, app updates actually seem to work way better across user profiles.

If I would use only one profile, and use the owner like you @N1b described, what is the attack surface reduction here?

You have appstores in the owner profile, which add a ton of attack surface. They connect to the internet and install apps.

You also always run playservices in the background, otherwise the playstore wouldnt work. So you have quite a lot of attack surface, dont you?

Also the issue with sharing files. Currently network over localhost works, but the future is unclear. Sharing via USB would require another app, to at least use public-private cryptography for the files. Otherwise using an unencrypted USB Stick would leave traces, and I know no USB shredding app on Android. Not sure if you can even shred flash storage.

Can you direct me to a list of things a guest profile cannot do, that the owner can?

user539

missing-root Also the issue with sharing files

Signal works great between profiles

N1b

missing-root what is the attack surface reduction here?

In the end it's of course up to you, and I can see why in your situation private space would make more sense. For me the reduced attack surface comes from:

Disabled apps in owner profile (where more harm could be done and every app is visible). Btw. you can also disable Google apps and appstores there whenever you don't run updates.
Better sandboxed apps in different user profiles, also fewer apps per profile in case of a breach.
Google is not installed in any of the user profiles, so it only sees the unused apps in the owner profile where no personal data will be shared via Play Services.
Much better agency over what I show police or border control in my user profile.
No data sharing between profiles (although that is a convenience issue as you mentioned).

I rarely have to share information between profiles, but in these cases I put them in Bitwarden since I use that everywhere anyway (or on a USB stick for lager files or data that needs to stay offline).

But these are only my reasons, I fortunately have an easy enough lifestyle for this to work with little to none of the complications. Private space can be a better alternative when data sharing is required and it's much better than work profiles.

missing-root

user539 of course it does. It connects to an external server.

missing-root

N1b

For good inter-profile-sharing, an encrypted solution needs to be there, with a permission to send data, and it needs to be there once they have different localhosts.

Maybe a permission to access usb devices, and an app that encrypts data then stores it on a usb device and automatically reads and imports it? Could even use the secure element, sounds very doable.

JollyRancher

greetdnashoe

Step 1: Install app on Owner profile, deny network access and disable App.

Step 2: Go to settings, manage users on Owner profile. Pick profile that you want the app in and then tap Install Available Apps and tap the one(s) you want installed in that profile.

Step 3: Handle any needed app updates through the Owner profile.

N1b

Exactly like JollyRancher described. It's a bit more effort and opsec as you need to do your updates manually, but for me it's worth the simple morning routine.

greetdnashoe

This is amazing. Thank you both for the clarifications!

N1b

Chefsnade Not sure about your question, but disabled means disabled as far as I know. The settings you describe only affect enabled apps, so you shouldn't have to deal with them separately.

My easy morning routine is:

Unlock phone (it's already in owner profile thanks to auto reboot)
Enable Play Store and Play Services (I do that via the official GOS App Store)
Open all my app stores and update the apps
Disable Play Store and Play Services again and move to user profile

Often there are no updates so this takes a minute at most.

Chefsnade

N1b sorry I should have added in the main owners profile. I've added all apps there to port across to other profiles.
But in the owners profile if I disable the app background battery and WiFi is still on - toggle these off correct? ATB