Google play services - internet access

AnorBanantje

Hey, is here any possibility to give access only for GMS to get apps notifications without allowing whole google play services with communication to google? Something like MicroG have configurable but here would it be in gmscompatconfig, i see here is possible to block play integrity requests looks like some control of traffic is already here.

MetropleX

AnorBanantje what do you believe giving network to Play without logging in gives to Google?Sandboxed Google Play runs in the standard app sandbox with absolutely no special access or capabilities. It can't do more than other regular apps. No need to grant any of the standard permissions for normal functionality. Can also avoid granting our Sensors permission to it too.

Using apps depending on Google Play implies using apps which include the Google Play SDK and libraries. Many of those libraries including Ads and Analytics can function without Google Play services, but not all do. Our approach enables using the standard app sandbox for the rest

Therefore granting network access as we have it available makes no difference or extra connections that would/will be made by apps depending on it anyway and many installed without it present will be making such connections regardless unless they have their network permission revoked also.

GMSCompatConfig is the configuration GMSCompat (our compatibility layer teaching Play Services how to run as standard apps) uses. None of it is user facing as it isn't intended to be. (No obfuscation on our part as the source is available) the config file enables us to make faster changes instead of an older process.

AnorBanantje

Thanks for the explanation, MetropleX I understand that GMSCompatConfig is an internal configuration tool for managing how GMS interacts with the system. You're right that, for apps relying on Google Play services, limiting network access to Google Play or controlling certain permissions (like sensors) can help reduce unwanted connections.

Regarding the specific question about giving network access to GMS without enabling full communication with Google, it seems like the current approach uses the standard app sandbox for GMS, so it doesn’t inherently grant extra permissions or capabilities to Google. I wonder if future configurations in GMSCompatConfig will allow us to fine-tune GMS's network access to only enable notifications while blocking other Google-related services. That could provide a better balance between functionality and privacy. Of course this is only nice to have. Sandboxing GMS self is too perfect for privacy in connection to normal gms

de0u

AnorBanantje I wonder if future configurations in GMSCompatConfig will allow us to fine-tune GMS's network access to only enable notifications while blocking other Google-related services.

This seems like a potential maintenance headache. Any release of GMS might shift from using specific servers/protocols for FCM to using something different. It's even possible that there could be code that would attempt to work around nation-state firewalls by using different connection approaches.

MetropleX

AnorBanantje wonder if future configurations in GMSCompatConfig will allow us to fine-tune GMS's network access to only enable notifications

This is something that primarily resides with individual app developers, if you look at what Molly has recently done they've integrated FCM in a way that users can utilise it with or without Play Services while also offering websockets and UnifiedPush.

Starting with v7.68.5-1, we've unified Molly and Molly-FOSS into a single fully FOSS app, with no proprietary dependencies.
We replaced the proprietary Play Services SDK previously used by Molly with our own open-source implementation, so FCM push notifications are now supported for all users.
If you have either Molly or Molly-FOSS installed, just update like usual. No migration needed.
Molly v7.68.5-1 is already available with Accrescent coming soon.

Source: https://fosstodon.org/@mollyim/115791864290732496