Exploit protection settings RESET themselves after update?

blackpill

As I started to dive into some ongoing issues that I've had with various Vanadium crashes, a kernel panic, and other issues, I noticed that ALL of my exploit protection settings were disabled in both the owner profile and the primary user profile that I've been using on my P8P.

I've had this device for probably 9 months now. I don't recall the last time that I checked those settings, but it couldn't have been more than 2 months ago. Does the update to Android 15 disable the exploit protection settings or am I potentially dealing with a more serious issue here?

I've been on the stable release channel the entire time FWIW. Virtually no apps installed other than SimpleX, Session, Obtanium and Keepass, and Aves Libre.

other8026

blackpill ALL of my exploit protection settings were disabled in both the owner profile and the primary user profile that I've been using on my P8P.

Which settings?

blackpill Virtually no apps installed other than SimpleX, Session, Obtanium and Keepass, and Aves Libre.

Did you change settings for just these apps, or did you change settings for system apps (which isn't advised)?

Network and sensors permissions were reset for a small number of users for a small number of apps, I think when apps were updated, not when the OS was updated. I could be wrong though.

Here's an announcement about it: https://grapheneos.social/@GrapheneOS/113357948290682072

Also, there was an added one-time migration that was supposed to run after updating to 2024102400. Here are a couple quotes from that release's release notes:

add an extra one-time migration of Network and Sensors being disabled in Android 14 to Android 15 to work around an issue with the previous migration of the permission state which occurred for some users with some of their apps

Maybe you have a pending update and you need to restart your phone to finish updating?

blackpill

other8026 Thanks for replying. My change management discipline is such that I apply stable OS updates within 24hrs or less from the time my device notifies me and GOS app updates when they're immediately available.

Regarding exploit protection settings, the only setting that I've ever toggled from the defaults were DCL in the owner's profile. I did this once to prevent DCL from both storage and memory (although it appears to be disabled).

Now here's something that I find a bit strange. When I drill into each app's settings, it reports that the various setting are enabled (HMA, memory tagging, et al):

https://imgur.com/05nptqr

However, the settings UI shows the opposite - as if all of the worst possible security settings are configured globally:

https://imgur.com/NHe3d3u

https://imgur.com/nr3X2lT

I'm not sure if that's some UI bug, but combined with the other crashes and kernel panic that I've experienced this past ₃ weeks I'm becoming a bit concerned.

Thanks for your time!

other8026

blackpill Sorry, maybe I'm missing something, but everything that I see in those screenshots looks fine, except maybe you had changed the default for DCL via memory to blocked, but now it's set to allowed?

In your screenshots, the example app is using the hardened memory allocator, and the list of apps that are disabled is empty, so that matches up. Same with native code debugging (it's blocked so the list of allowed is empty).

As for the issue that I mentioned earlier with sensors and network, I don't believe any of the settings you've mentioned were affected because they're handled differently.

blackpill

other8026 I realized that this dialog is actually not to enable or disable settings, but rather to review the settings:

https://imgur.com/NHe3d3u

The settings menu for these Exploit protection dialogs doesn't really make it clear that it's like a read only dialog to review those settings, hence the confusion :(