Multiple profiles isolation

DeletedUser410

Hi.
I was unable to find an answer on the forum.
Very simply put.
I use multiple profiles. I have to use an app that I do not fully trust in terms of security.
My idea is of course to install it in a separate profile with network only permission
Let' s say this app gets somehow compromised.
Would other profiles be at risk as well?

Dumdum

DeletedUser410
As long as you only install it in the secondary profile, it should stay in that profile.

cloudcoroner the only profile that does not share applications is private space.
while private space has separate application installs as well as separate app user profiles.

I don't think either of these statements are correct. Private Spaces are the same as any other profiles, just that they can be accessed from a regular profile without the need for switching.

Your statement about "Traditional second profiles utilize the same application installation" - technically true, but thats if the app is installed in multiple profiles (which I think the OP is asking about apps installed only in the specific profile). And once again, it should also apply to Private Spaces too.

de0u

DeletedUser410 Let' s say this app gets somehow compromised.
Would other profiles be at risk as well?

That would be less likely, but in theory a really good exploit could get past the isolation provided by user profiles. User profiles do not provide the same isolation that a separate device does.

cloudcoroner

As i understand it, the only profile that does not share applications is private space. "Traditional" second profiles utilize the same application installation but separate app user profiles, while private space has separate application installs as well as separate app user profiles.

Specific to your use case of app compromise, private space would be your best option to address that concern. However, private space storage can be accessed from the owner profile, so there is risk of malware exfil from the private space if pulled from private space via the owner profile, but that is not specific to an application compromise. You can also delete the private space anytime there is a concern.

DeletedUser410

Dumdum
Yeah I would be installing it in 2nd profile only
In other profiles I would therefore not have any instance of the app.
Would that isolate it?
That is what I seemed to understand based on the documentation I found around.
Just wanted to make sure.

cloudcoroner

Dumdum
When you install an application in a user profile, it installs for the device and is enabled for that user. If another profile user installs the exact same app, it is not installed, it is just enabled for that user. This is how apps are updated across profiles if one user updates the app. The users/profiles have different app profiles to keep settings, etc separate, but the install is the same. IF the app is compromised in one profile, it is compromised for all.

Private space is a separate install, separate update mechanism, etc. If an app is compromised in private space, it will not be shared across any profile. Although, as @de0u said, a good exploit could break out of any logical isolation.

DeletedUser410

de0u
That was my concern
I have more than one device and I was unsure on how to set it up.
Having all apps on one device using multiple profiles is more convenient, but in order to avoid 100% the chance of a compromised app(even if the possibility is slim to none) physically separating the devices is the safest route

de0u

cloudcoroner Private space is a separate install, separate update mechanism, etc.

I guess that could be true, but it would be surprising. Is it possible to cite a source?

harp

cloudcoroner Private space is a separate install, separate update mechanism, etc. If an app is compromised in private space, it will not be shared across any profile.

No, it's still wrong. Just tried it: Created a completely new secondary profile. Created a private space within that profile. installed an app only within that private space. It was an app, which is not installed in any other profile and was never installed on that phone before anywhere. After that locked the private space. Turned off the secondary profile (by end session). Back to owner profile it's app list shows this specific app as installed, but not fur the current user (owner) so it's the same behavior like it would be installed directly in a secondary profile.

So as @Dumdum wrote sharing resources like installed apps is the same in secondary profiles and private space.

Edit: Hm, Maybe I have to correct myself: There seems to be a difference after all. Checked the app list in owner profile again, at the details page of an app installed in 2nd profile directly the 3-dots-menu in the upper right corner is shown with the option to uninstall that app from all users. At the details page of the app installed in private space directly, it can't be seen.

de0u

harp Try installing an older version of the same APK outside the Private Space.

harp

de0u Good suggestion.

The app used for my installation trial is ExifEraser. Installed via Accrescent in private space, most recent version there is 6.3.0. Tried to install version 6.2.0 via Github in the 2nd profile directly, wasn't able to because of 'invalid version'. But there's a more recent version (6.4.0) than in Accrescent available. That could be installed. And voila: it was updated to version 6.4.0 in private space too! Back to owner profile the option to uninstall from all users was available (as expected). After uninstalled by this option, it was gone from the 2nd profile and private space.

Tried the same vice versa, same behavior: Installed 6.3.0 via Accrescent in 2nd profile directly, installed version 6.4.0 via Github in private space, it was updated in 2nd profile too. Uninstalled from all users in owner deleted the app from 2nd profile and private space.

So that should prove our assumption of global installation and update processes in secondary profiles and private space in the same way is correct and the way @cloudcoroner described is not.

Edit: But it's still curious, why the option to uninstall from all users isn't available when installed in private space only.

n3t_admin

harp So that should prove our assumption of global installation and update processes in secondary profiles and private space in the same way is correct

That may honestly come as a surprise only to you, sorry ^_^'.
It has been known for a long time that Android can only install one version of an app across all profiles, since it shares the same APK across all users; although every individual user has their own data directory for said app.
Naturally, the version has to match as well and will be updated across all profiles.

harp But it's still curious, why the option to uninstall from all users isn't available when installed in private space only.

That's not very surprising. Private space is supposed to hide apps from all other users (including owner) when locked. Secondary user profiles (or even work profiles) were never designed with a privacy or security approach in mind, but rather a "family tablet the kids can use" situation. So, in private space, the app can't be uninstalled for all users, since it's considered "hidden" even by the owner profile. I hope that makes sense.

harp

n3t_admin That may honestly come as a surprise only to you, sorry ^_^'.

Maybe you should read the posts I wrote before more carefully. I wasn't surprised, but was convinced it is as it is at first. The point that surprised me and made me a little doubt, was the fact, uninstalling globally wasn't available in owner's app list although the app was shown there.

n3t_admin Private space is supposed to hide apps from all other users (including owner) when locked.

Again, please read carefully all posts: As I stated the app was listed in the owner's app list while it was installed only in private space of a secondary profile and nowhere else and wasn't anywhere and anytime before. Although it was listed in owner's app list the option of uninstalling globally wasn't available. Only after it was installed directly in a 2nd profile too the option was available.

So, carefully reading the thread and it's post can prevent you from misinterpreting them. ;) The only one here, who suspected a different behavior was @cloudcoroner.