Why are apps from Google Play pinging servers with unchecked Network Access

akd77

Why are the apps I'm installed from Google Play pinging their servers, even if I didn't check to allow network permission?
See my DNS Logs:
https://i.postimg.cc/yd5T4kCp/Screenshot-2025-03-22-at-6-53-31-PM.png

And looks like a google connectivity check is going through - I though Graphene has their own implementation?

pxlkng

akd77

Even without network permission, apps could still try to ping domains if I'm not mistaken. Have you verified that the logs you see actually mean that the call went through, or just that they tried to ping and failed?

de0u

akd77 Why are the apps I'm installed from Google Play pinging their servers, even if I didn't check to allow network permission?
See my DNS Logs [...]

A DNS lookup is not the same as a network connection, any more than reading the title of a book on a shelf is the same as reading the book.

This material from the GrapheneOS FAQ may be of interest: https://grapheneos.org/faq#other-connections

n3t_admin

akd77 which device were these logs taken from? If it wasn't the Pixel, I would actually be concerned since disabling network permission would stop all network activity for a certain app. If you want to double-check which app is querying the domain(s), I would suggest installing RethinkDNS in the affected profile(s).

akd77

Another issue I'm seeing, is that if I install an app in the Owner profile with no Network permission, then add the app it to another profile through the profile manager, the app installed on the other profile gets network permission enabled by default.

yellow-leaves

akd77
This is normal, apps pushed into another profile from within owner profile always gain this permission.
I don't think it should be like this, but that's how it works.

ignoramous

ex-AOSP tinkerer here

pxlkng apps could still try to ping domains if I'm not mistaken

This was true until Android Q and below. On Android R+, this shouldn't be the case.

de0u

n3t_admin Disabling network permission would stop all network activity for a certain app.

https://grapheneos.org/usage#app-link-verification

n3t_admin

de0u I don't know what you are trying to tell me here.

de0u

n3t_admin Disabling the network permission for an app does not disable the network permission for the Intent Filter Verification Service app, which is designed to carry out network activity that can confuse people into believing the app is responsible for the activity.