Hello everyone,
I'm developing a personal Android app to read my step count from the Health Connect API, and I've run into a permission issue that seems specific to the GrapheneOS security model. I'm hoping someone with more expertise on the OS can shed some light on what might be happening.
My Setup:
- Device: Google Pixel 6a
- OS: GrapheneOS (latest stable version)
- Profile Setup:
- Owner Profile: De-Googled (no Google Play Services).
- Secondary Profile: Used for this testing. It has Sandboxed Google Play installed and active.
- App: Health Connect is installed and active on the secondary profile (via the Play Store). I can open it, and it works with other Play Store apps like Google Fit.
The Goal:
My app, which I'm installing directly from Android Studio (sideloading), needs to request the android.permission.health.READ_STEPS permission.
The Problem:
My app correctly detects that it doesn't have the permission. However, when it tries to launch the permission request using the official PermissionController.createRequestPermissionResultContract() from the Health Connect library, the request fails silently. The Health Connect permission screen never appears, and my app's logic shows a "Permission denied" message. My app also never appears in the "App permissions" list inside the Health Connect app.
What I Have Already Tried (Troubleshooting Summary):
I've gone through an extensive debugging process and can confirm the following:
- The code is correct: The app uses the latest Health Connect library and the official, recommended method for requesting permissions. The code works on standard Android OS.
- The Manifest is correct: The
AndroidManifest.xml correctly declares the READ_STEPS permission and the required ACTION_HEALTH_CONNECT_PERMISSION intent filter.
- It's not a debug key issue: I generated a private release key, signed the app, and installed the release APK. The signed app has the exact same problem.
- It's not a battery issue: The app's battery usage is set to "Unrestricted".
- It's not just a secondary profile issue: I replicated the entire setup on the Owner profile (by installing Sandboxed Play and Health Connect there) and the result was the same. The permission request still fails.
My Questions for the Community:
- Is there a known security policy in GrapheneOS that specifically prevents a sideloaded application (even a release-signed one) from launching an
Intent into the sandboxed Health Connect service?
- Is there a special permission, developer setting, or an ADB command I might need to use to allow this specific kind of inter-app communication between a sideloaded app and a sandboxed Play Service app?
It seems like there's a security boundary I can't cross, and any advice or insight would be greatly appreciated. Thank you!