Newbie Question: App Isolation

Firstdonotrack

New convert here. I appreciate the OS and the devs maintaining it.

I recently installed Tailscale, a wireguard-based networking tool, and noted that the logs were recording EVERY action I had performed on the device, even when the app wasn't active or connected to the Tailscale network. It recorded app usage, states on open and close, and more. I've since removed the app.

However, I was under the impression that apps essentially didn't have the level of privilege required to make such observations, due to sandboxing. Have I misunderstood how sandboxing works?

When trying to pass address details from one navigation app to another, I have observed that apps cannot interact with each other but Tailscale's system logs have raised concerns about observation. Whilst apps can't interact, does sharing a profile allow them to observe/spy on each other without interaction?

MetropleX

Firstdonotrack apps installed in a profile together can all see each other, they cannot see what they do however and they can't access each others files unless they're given legacy permissions (if they request access to all media use Storage Scopes to govern them), they also can't interact with each other unless explicitly stated in the manifest and only via IPC. If you use the share dialogue that is one version of an IPC interaction. Copy pasting an address isn't and is generally controlled by the OS, unless you trust your keyboard to and toggle it on in it's settings.

The OS logs all app and system activity (logcat).

If you've given Tailscale VPN permission it will obviously record in the logs what activity those apps are doing via itself.

Watermelon

Firstdonotrack Firstdonotrack What you're describing sounds as if you granted the Tailscale app the app usage data special permission. You can find it in: Settings > Apps > Special app access > App usage data.

Firstdonotrack

fernlike, MetropleX — thank you both for your responses.

I'm aware that Tailscale isn't an anonymity service but the level of logging was concerning. I wish I had saved them. I was seeing app activity recorded in their logs. App names. Open times. Close times. Reasons for closing: minimized to home screen or because another app opened etc.

I've since removed and replaced the service on all devices so I can't replicate it, sadly. It freaked me out so much I removed all trace before stopping to save logs etc. I was under the impression that apps could see each other but couldn't interact or - consequently - observe each other's activity beyond presence.

If app activity can be observed within a profile, I'll need more profiles. Is that the case? Can apps observe which apps are present AND when they're opened/closed?

fernlike

To add to Metroplex's answer, note that Tailscale isn't an anonymity service: https://tailscale.com/blog/tailscale-privacy-anonymity

[...] the fact that your tailnet exists is known to us because of How Tailscale works. Your identity is known to us. The names of your computers and your IP addresses, and which of your nodes connect to which others at which times, are known to us, because our servers are needed to facilitate the peer-to-peer connections. The vagaries of your firewall's obscure NAT traversal bugs in every possible unusual situation are, unfortunately, known to us.

Firstdonotrack

Watermelon – thanks for the update. It looks like you may be right but I'm not aware of how that permission could have been granted. The app only has three permission controls: Network, Sensors, Notifications.

The only other relevant capability listed under the App Info permissions is 'Query all packages', but 'query' is obviously not observe.

How can an app be given a permission it hasn't requested?

Watermelon

Firstdonotrack thanks for the update. It looks like you may be right but I'm not aware of how that permission could have been granted. The app only has three permission controls: Network, Sensors, Notifications.

You didn't look in the place I told you.

Firstdonotrack The only other relevant capability listed under the App Info permissions is 'Query all packages', but 'query' is obviously not observe.

You've taken this info from the app's all permissions section. Note that this section has been said to be misleading by the GrapheneOS team. You shouldn't rely on the info it tells/doesn't tell you. You should rely on the normal user-facing togglable permissions list.

Firstdonotrack How can an app be given a permission it hasn't requested?

Misclick, or being drunk and forgetting about it, for example. There's many ways. It's a vague question. GrapheneOS includes a protection against maliciously tricking you into granting a permission by misclicking, by adding a 1 second delay before the allow buttons in the permission prompts are functional. This gives you at least 1 full second to watch the permission prompt. Still, it's not a perfect protection, and there's some ways apps can grant themselves permissions, for example if you gave them the incredibly dangerous accessibility permission (I believe when you grant it, the prompt says something like "Allow (app) to have full control of your device?").

Firstdonotrack

Watermelon

You didn't look in the place I told you.

Apologies. I replied hastily. I did look in the correct place and the app isn't listed there. I've reinstalled it and haven't been able to recreate the logs I'd seen, and it definitely isn't listed under App Usage Data.

You've taken this info from the app's all permissions section. Note that this section has been said to be misleading by the GrapheneOS team. You shouldn't rely on the info it tells/doesn't tell you. You should rely on the normal user-facing togglable permissions list.

I wasn't aware but I appreciate you sharing that with me. Thank you. I'll dig further. As I'd mentioned, the app only has three permission toggles: Network, Sensors, Notifications. I don't see any way to grant it access to App Usage Data. Only F-Droid and Aurora have requested it and neither has been granted permissions.

Misclick, or being drunk and forgetting about it, for example.

I'm beginning to think I may have somehow mistaken system logs for the Tailscale logs because I can't recreate it at all. I can see no way to give the app that level of permission. It doesn't ask for it and it's unlikely my dumbass self has stumbled on a zero day bug within a few days of using the OS. I'll chalk it up as user error for now and monitor it over a few days in an isolated profile.

I'm very grateful for your help. Thank you again!