Exploit Protection (memory tagging etc.) which Settings?

dhhdjbd

Hello, i have a questions about the exploit protections.

What are the correct settings here? i noticed that memory tagging is off for almost all of my (non system) apps and basically all of the enable/ disable for third party apps options in the exploit protection settings use the "less" secure mode.

Should i change this? As far as i understood, grapheneOs has picked already the most optimal options for me

All my apps are installed with google play, im not sure if this is relevant. (is this how you would also install apps btw?)

In particular, i noticed whatsapp memory tagging is off and i think i have read people mentioning it and whatsapp here

Thanks for the OS, i am using it for months now and i couldnt be happier. for me everything works almost always with it

thmf

dhhdjbd All my apps are installed with google play, im not sure if this is relevant. (is this how you would also install apps btw?)

This is one of the safest approaches if security is what you're after. It's recommended by the project.

dhhdjbd i figuered out i can just enable all the settings, and then disable some if a app stops working (which i guess is the normal way to do it)

I guess this is the only way to know. I do it the same way.

dhhdjbd it seems like some apps will try do use DCL, but will keep working fine without it

Correct. Leave the protections on if they don't interfere with the apps. It's safer this way.

dhhdjbd Interestingly, amazon shopping and kindle both crash because memory tagging detected an error. not really sure how i should feel about that.

If MTE detects an error, this means there's an error in the app and it should be communicated to the app authors. GrapheneOS can't do much about it.

dhhdjbd if someone thinks i did something wrong, please tell me, thank you

Everything seems good to me. Stay safe with GOS :)

dhhdjbd

i figuered out i can just enable all the settings, and then disable some if a app stops working (which i guess is the normal way to do it)

It seems like DCL via memory/ storage creates the most (only) problems. Spotify required dcl via memory, while netflix requires dcl via storage for examle.

i didnt test everything, put it seems like some apps will try do use DCL, but will keep working fine without it. not sure if bugs will appear later or if its all optional features they try to use...

Interestingly, amazon shopping and kindle both crash because memory tagging detected an error. not really sure how i should feel about that. I can live without amazon shopping, but i kinda like to use kindle?

if someone thinks i did something wrong, please tell me, thank you