RE: Google sandboxed profile

Tlhokaina

Is the expectation that the user sandboxes Googleland in the Owner's profile or is a separate profile usually created for that?
On a related question, does the Owner profile hold the installed apps and the apps are then pushed to other profiles from there?

Probably9857

Tlhokaina Is the expectation that the user sandboxes Googleland in the Owner's profile or is a separate profile usually created for that?

That is entirely up to you. A separate profile will provide stronger isolation from the other apps and data on your device. But that comes with some inconveniences. I don't think there is any clear preference among the community (some strong opinions on both sides probably).

Tlhokaina does the Owner profile hold the installed apps and the apps are then pushed to other profiles from there?

That is one way of doing it, but apps can also be installed directly in non-owner profiles. One benefit of pushing from owner is that it makes it easy if you want the same app in multiple profiles.

pxlkng

Probably9857 A separate profile will provide stronger isolation from the other apps and data on your device.

No, profiles do not aid the app sandbox. They do not isolate the app (more) from the rest of your device or data.
It does not make it more secure or sandboxed.

What it notably does is prevent package discovery and IPC across those profiles.

But it is exactly the same app sandbox as it would be in Owner.

It is recommended to use profiles based on personas (Personal/Work/School), not app or usage categories. So creating a profiles solely for sandboxed Play Services is not the recommendation and has little if any privacy benefit and no security benefit concerning the app sandbox.
If you don't want to make use of profile specific features (putting them at rest individually, different unlock method, etc) then you should just put sandboxed Play Services in your main profile with your other apps - don't make life more complicated than it has to be.

Probably9857

pxlkng No, profiles do not aid the app sandbox.

Good thing I didn't say that.

Probably9857 A separate profile will provide stronger isolation from the other apps and data on your device.

And I'm pretty sure what I did say is strictly true. To be more precise, it is an additional layer of isolation.

Psyonico

There is no expectations when it comes to how you set up GOS.

Some people only use an owner profile without Google Play Services
Some people only use an owner profile with Google Play Services.
Some people use multiple profiles and only have Google Play Services installed in one profile
Some people use multiple profiles and have Google Play Services installed in all of them.

It really depends on what your threat model looks like and what you're comfortable with.

Similarly with app installs you don't need to install everything in the owner profile if you don't want to.

You have to kind of base it off of a convenience vs privacy debate. Even if you only use an owner profile you are leagues ahead of other Android builds just by using GOS.

Tlhokaina

Psyonico

Thank you for your response.

harp

pxlkng They do not isolate the app (more) from the rest of your device or data.

Really? AFAIK apps can share some data if they allow each other, so let's say app A shares some data with App B and maybe vice versa. If App A is only installed/enabled in owner and App B in privacy space or a secondary profile, they shouldn't be able to communicate?

Probably9857

pxlkng No, profiles do not aid the app sandbox. They do not isolate the app (more) from the rest of your device or data.
It does not make it more secure or sandboxed.

What it notably does is prevent package discovery and IPC across those profiles.

Tell me then, what is doing the IPC? Is it apps? What is being communicated? Is it data?

Probably9857

pxlkng What it notably does is prevent package discovery and IPC across those profiles.

And since you've got me triggered now...😄

The OP is specifically referring to Google services, which could be accurately described as an ecosystem-wide IPC framework.

It's not as if IPC is some kind of afterthought in this discussion.

/rant

wuseman

As the others have touched upon, it's up to you.
I don't currently own a Pixel, but the plan for me is to run everything in the Owner profile. Hopefully we'll be able to create more than one "Private space" in the owner profile in the future. Switching profiles to access certain apps is too much of an inconvenience IMO.

pxlkng

harp

Yes really. And yes, that's IPC, I mentioned that.
But this is really a non-issue for most cases. Apps need mutual consent to talk to each other and then decide what data they want to share. They can still only access their own data and what gets shared with them. They don't get arbitrary access to another apps data.

harp

pxlkng They don't get arbitrary access to another apps data.

That's for sure, I mentioned that by 'if they allow each other'. But some users might want to prevent even that communication by mutual consent. That's more for privacy reasons rather than security.