QUERY_ALL_PACKAGES visibility (Private Space, separate profiles)

AtmosphericIgnition

Hello,

I was wondering if an app with the QUERY_ALL_PACKAGES "permission" is able to:

See apps located inside Private Space when the app is installed outside Private Space?
See apps located outside Private Space when the app is installed inside Private Space?
See apps located in other profiles when when the app is outside Private Space? Is the owner profile treated different by this permission?
See apps located in other profiles when when the app is inside Private Space?

This question popped up in my mind when I saw that the "Apps" section of Settings shows apps installed in other profiles (but not those exclusively inside Private Space).

Thank you for any info on this. I tried looking in the official Google Play and Android documentation, but didn't find any answers.

AcclaimSublevel19

AtmosphericIgnition I was wondering if an app with the QUERY_ALL_PACKAGES "permission" is able to:

See apps located inside Private Space when the app is installed outside Private Space?
See apps located outside Private Space when the app is installed inside Private Space?
See apps located in other profiles when when the app is outside Private Space? Is the owner profile treated different by this permission?
See apps located in other profiles when when the app is inside Private Space?

No, no, no and no. Profiles and completely separate their data from each other and private spaces are profiles in a profile, so the same rules apply.

AtmosphericIgnition This question popped up in my mind when I saw that the "Apps" section of Settings shows apps installed in other profiles (but not those exclusively inside Private Space).

This is only true for the owner profile that manages the phone. It's only available to Android internals AFAIK.

userofgos

AtmosphericIgnition See X thread: https://xcancel.com/GrapheneOS/status/1906785133216031206#m

iOS also has ways to detect the other installed apps. Fully preventing is a long road requiring user-facing complexity neither iOS or Android has be willing to add to the OS.

Current versions of the Android Open Source Project prevent apps from detecting other apps installed in different profiles on a technical level rather than via store policy. GrapheneOS made changes to close holes in this earlier. Doing it within profiles require UI complexity.

We've been working on an App Communication Scopes feature for a long time to provide user control over apps detecting or communicating with other installed apps. It's invasive and not simple to provide it. Profiles are a more complete solution and cover many indirect methods.

QUERY_ALL_PACKAGES permission is not at all required to obtain a list of other apps installed in the same profile. It's not a user-facing permission for a reason. Looking at the low-level requested permissions is highly misleading. This is one example of why that misleads people.

The low-level permissions marked dangerous are grouped into the user-facing permission toggles. Some people get the wrong idea that them being requested at a low-level grants them at install time.

For example, READ_CONTACTS, WRITE_CONTACTS and GET_ACCOUNTS are controlled by the Contacts toggle. There's also an OS contact picker not requiring a permission.

Our Contacts Scopes is a way to give fine-grained access to a subset of data for specifically chosen contacts for apps requesting the Contacts permission group.

The rest of the low-level permissions marked as normal. Many people get the wrong idea that these are simply granted at install time, but that's a shallow and incorrect understanding of it. Many correspond to special access permissions toggles which are off by default for the invasive ones. Others have case-by-case request systems. Others have other toggles including battery mode corresponding to the functionality: Restricted vs. Optimized (default) vs. Unrestricted.

The query declaration system allows a store to review which apps an app says it needs to directly detect as installed in the same profile. User control over queries would be possible but would not hide other apps. That's a misconception, and the posts about this assuming that would be the case are incorrect. There are also plenty of other ways to detect other apps in the same profile similarly to how it can be done in iOS by detecting their APIs being available. Providing a UI to control queries would be quite complex without actually providing what people want which is fully hiding which other apps are installed in a profile.

QUERY_ALL_PACKAGES is just the catch-all case and apps can declare specific queries for specific apps and interfaces. It's possible to declare a catch-all query for any app exporting any interface without QUERY_ALL_PACKAGES anyway. A more specific approach is declaring a query for a launcher activity which every Play Store app is required to have, similar to what a launcher would need to request. What would be the point of a toggle for QUERY_ALL_PACKAGES? People looking at the non-user-facing low-level permissions are already misled by this, and making it user-facing would make that a much bigger problem. You'd need a whole menu for controlling queries for types of interfaces, apps or all packages in the profile. It is not actually what people want and an overly complex way of doing things, so that's not a good approach and much worse than our App Communication Scopes plans.

Apps can see what other apps you have installed in the same profile via indirect ways that don't require QUERY_ALL_PACKAGES. That permission isn't really what gates app from being or not being able to do this.

If you want apps to not know about each other, put them in separate profiles.

This might be tackled when the app communication scopes feature is done, but it's too early to say at this time.

Vincent96 See github issue tracker for App Communication Scopes here: https://github.com/GrapheneOS/os-issue-tracker/issues/2197

AtmosphericIgnition

AcclaimSublevel19 Makes sense, thanks for the answer.

Vincent96

GrapheneOS are considering making a privacy toggle to block apps from seeing all installed apps. Does anyone have the link to this issue?