How well do push notifications work with sandboxed Google Play Services?

Sprout5888

I am in the same boat with the OP. Just ordered a pixel 6a.

I would like to add a question too:
I am not familiar with all the abbreviations so excuse me if you already answered above but if I am only planning on using the f-droid and aurora stores, do I have to still install google play store or the only important app is the google framework?

If we have to install all google play apps to have notifications do we have to log in with any google account?

Thank you

unwat

Sprout5888

For notifications you need to install all three apps: Google Services Framework, Google Play Services, and Google Play. The GrapheneOS Apps app will install all three even if you try to install just Play Services because of dependencies.

Important that you install all of them before other apps so notifications are "registered" correctly.

And, no, you don't have to log in. Actually, I sometimes log out and later log in again and my notifications work regardless so I think they're tied to a device ID, not a login.

Sprout5888

unwat Thank you! I guess the best we can do is to limit these Google apps to only have internet access but nothing else.

unwat

Sprout5888

If all you want is notifications, Google Play Services needs internet access. Google Play Store doesn't.

Oggyo

mythodical GSF doesn't require permissions, nor battery exceptions. As far as I know, Play Services and Store both require network permission for notifications and other service deliveries to work correctly.

I see, this makes sense. However, I found that removing the Network permissions from GSF removes them from Google Play Services, too. Somehow both apps/services are linked.

mythodical

Oggyo Hm, that doesn't seem right. It has been a while since I tested a profile with all three Play components, but when I did I was able to pick and choose which of the components had specific permissions.

Oggyo

mythodical It has been a while since I tested a profile with all three Play components, but when I did I was able to pick and choose which of the components had specific permissions

How it's is now at your side or it's only (not right) for me?

TrustExecutor

What I fail to understand is exactly what data is relayed by Google when I get a notification from an app e.g Signal? Is the message body sent in the notification?

Or, is the notification service just letting Android know there is a message for a specific app, and then the app goes to contact the server to receive the message?

mythodical

TrustExecutor @unwat answered this in another thread recently, which does a good job of explaining Signal's implementation of Firebase. Other apps may use less private implementations of the same API.

mythodical

Oggyo if I understand your question, I think you should be able to set individual permissions on all three components without one overriding the others.

For example, you should be able to allow network permission for Play Services, while disallowing it for the Play Store and GSF.

Oggyo

mythodical
Technically, I'm able to set permissions to all three components, but practically, what permission I set for GSF overwrites GPS ones and vice-versa. So I can't have no Network permissions on GSF and Network permissions enabled in GPS. I hope this explanation is better. :)
GPS = Google Play Services
The third component Google Play Store is not affected by the permission changes described above.

unwat

This has tripped me up in the past too.

Seems GSF and Play Services share permissions. There used to be a notice somewhere saying as much but I can't find it now...

muhomorr

unwat There's a notice about this on Storage Scopes screen.

This is not something that is special about GSF + Play services, this is a standard (though deprecated) sharedUserId Android feature:
https://developer.android.com/guide/topics/manifest/manifest-element#uid

Apps that run in the same sharedUserId are effectively parts of one app.

unwat

muhomorr

Oh. Got it. It was depreciated before I switched to Android, so I didn't even know that was possible. Makes a lot of sense, though.