Google Play "isn't allowed to intsall unknown apps from this source"

empty731

Hello,
I'm getting an error when attempting to update or install apps via Google Play. "For Your security your phone currently allowed to intsall unknown apps from this source". I do not have the install from unknown sources enabled on Google Play. I installed the play store through the "App Store

Is this expected behaviour? If not, do you know how can I address it?

version 45.1.12-31 [0] [PR] 729649519

com.android.vending
versionCode 84511230

targetSdk 35
minSdk 31

Installed: Mar 7, 2025; 1:44 PM
Updated: Mar 14, 2025; 3:15 AM

c86

empty731

Try enabling install from unknown sources in Play Store settings.
When you install an app for the first time it pins the source, be it from Play Store or a trusted developer's GitHub. All future updates are checked for the same source before installing.
The only locations I have restricted for installing is the Files app and Vanadium, Play Store is allowed.

empty731

Thanks, do you know if is enabling "install from unknown sources" is a security risk? Do you know if this is the recommended practice?

c86

empty731

Of you downloaded Play Store and the associated sandboxed Google Play services from the GOS app store I don't believe it's an issue. I haven't modified my Play Store settings and checked my other GOS device, it also is set to allow.

I'm not sure why yours is different. Only thing I can guess is you may have adjusted some settings that are applied globally so it's occurring there? Similar to all the exploit protection settings that can be individually adjusted but also globally.

If you're concerned, verify the boot hash on the start screen with what's on the GOS install page. That will confirm your device is running as it should be. You could delete the full sandboxed Google Play again, reboot, then install them again and check your install allowance.

But I'm fairly certain "allow" is what you'll want in Play Store, with "disallow" for files and any browsers you have. If you disallow there but get apps from trusted devs, you'll get a notice on screen to adjust this setting for download/updating. I do this for one of the apps I use directly from a developer, turning it on when I need then off once done.

Cdc

Something isn't right in my opinion. Once you have Google Play and install apps through it then it should work. I'd try uninstall app and install it again. Perhaps do that with Google play as well.

empty731

That was my worry.. it seems something is not working. I tried uninstalling the Play Store & Play Services and reinstalled them, but the issue persists. I also logged out of the Google account on the device and logged back in.

Not sure what else to try, any suggestions would be appreciated.

spring-onion

Everything is working as intended, you're looking at a standard permission here. It must be enabled for an app to be able to install other apps. Google Play is a user installable app with no special privileges on GrapheneOS, so it respects this setting.

empty731

Thank you, I don't have auto updates on the PlayStore. Maybe I haven't opened it in a long enough time where the permission was revoked? I've re-enabled it, thank you for confirming that it's intended.