Separate user, work profile and private space

tempproc

Hi,

I'm very interested by the insulation model people use on GOS.

Using secondary profiles as my main as I originally planned is unfortunately a no-go since developper options don't work, which could be okay if Owner developper settings are inherited by other profile which I'm not sure of, but the lack of SIM setting is not possible which make secondary profile useless to me. I'm sure I'm missing other limitations but those where the two immediate deal-breaker that made me turn around.

That leaves me with having to use Work profiles with Shelter/Insular and/or Private Spaces on the owner account, which I'm not thrilled by since I would have love to use separate profile.

My questions are:

Can you set-up several work profiles per user
What's the difference between Work Profile and Private Space in terms Network configuration, Storage and Contact scopes, but also App iterations and IPS?
And how do you personally use those?

Thanks.

Elgoog

tempproc Have you viewed this video by Side Of Burritos?

Byku

tempproc

No. Work Profile + Private Space is the most you can get.
Private Space is more isolated and can be set up from OS without the use of 3rd party app. Work profile requires a device admin app to manage and cannot be managed from outside, even with ADB. On the other hand it is better integrated into the UI imo, you can control it via a tile and more custom launchers support it. Both WP and PS can have separate VPN. Storage and contacts are separate but work profile and owner can share contacts and app data if allowed to.
Owner - Play Services+Android Auto+FOSS/privacy respecting apps; Work Profile - no Play Services, Google/Meta/intrusive stuff; Private Space - NSFW content I guess (I haven't figured what to use it for yet); Secondary Profile - Play Services+Play Store+Banking apps

tempproc

Elgoog I actually did, but I guess I have trouble understanding how it works at the system/kernel level in terms of "separation" and the difference between the two

tempproc

Byku I guess I'm trying to understand how the "isolation" work. Work profile sound like it might have better security, I would in fact be using for enterprise-grade software that sometimes need to have a compatible OS and work profile to run.

Overall I'm trying to figure out the chain of set-up and insulation logic to go by while preserving conveniency which profiles don't allow for, but being limited to just a work profile and one private space for the Owner is kind of limiting as well

user2025

Im confussed by your term of "work profiles"...
I think they are "other user" profile in technical OS terms.
Work or personal or google or social_media profiles, are just other user profiles but adapted at logical & usage level by the owner.

In the other profile called work ot personal, i would configure applications and settings to match the usage of the "user profile",eventually combined with personal private space.

Remmeber that lets say Firefox installed in owner profile can be pushed assigned to another user profile from the owner users management setup. Is the same applications but locked & isolated settings per app,per profile,per space.
However,if you install Firefox in the other user profile,is standalone AND cannot be a lower version,running standalone in that profile.
Same,in a locked personal space,installing,adding Firefox creates another instance,a third app if i can say so,with its own settings.

Im using Rethink on all profiles and spaces.
In a profile,is installed in the profile and eunning there AND is installed and running in private space ! They dont see each other,have separated folders and...not the same access and reporting logs !

Byku

user2025 Im confussed by your term of "work profiles"...
I think they are "other user" profile in technical OS terms.
Work or personal or google or social_media profiles, are just other user profiles but adapted at logical & usage level by the owner.

No. OP mentioned Shelter/Insular. It existed on Android before Private Space was a thing. Work profile is something that can be created on your phone using an external app. It was made so your employer can install company software on your phone which is controlled by the company, not by you. Don't ask why would someone let a company invade your private phone instead of providing you with a work device but here we are. Anyway with the apps like Shelter you can create and manage this work profile by yourself.

tempproc

user2025 I will look at Rethink, seen it mentioned a few time.

Work profile is an insulated profile that can be remotely managed or more importantly, monitored for security purposed.

And for some reason Insular/Shelter allow you to run such a profile but within your owner profile, which solves some of the problems I mentioned with secondary profiles in not being able to access some options like Developper Mode or Sim settings.

Private Space seem to also be able to do the same thing as a secondary profile, so might as well use it, but don't know about it working for work suites.

All-in-all the other question (which is a noob question) is also what are the differences in separation/insulation at the system and kernel level of these different options

tempproc

Byku In case you're wondering, the main use for a Work Profile, besides monitoring employees which I not the purpose here, is actually the monitoring security and safety of a device by a dedicated external cell or company which beats any security or specifically detection and response that personal softwares can provide.

Byku

tempproc All-in-all the other question (which is a noob question) is also what are the differences in separation/insulation at the system and kernel level of these different options

This post might be of use to you

https://discuss.grapheneos.org/d/16559-difference-between-work-profile-and-private-space/8