Protonmail keystore issue

mazenetic

Is anyone else getting a Protonmail keystore issue similar to the one outlined on this page?

https://proton.me/support/android-keystore-issues

Logs:

==================== Proton Mail (ch.protonmail.android) – SELinux denials ====================

02-17 12:55:53.422 W tonmail.android: avc: denied { read } for name="u:object_r:odsign_prop:s0" dev="tmpfs"
02-17 12:55:53.422 W tonmail.android: avc: denied { getattr } for path="/apex/apex-info-list.xml" dev="tmpfs"
02-17 12:55:53.514 W main: avc: denied { read } for name="u:object_r:build_attestation_prop:s0" dev="tmpfs"
02-17 12:55:53.514 W main: avc: denied { read } for name="u:object_r:build_attestation_prop:s0" dev="tmpfs"
02-17 12:55:53.514 W main: avc: denied { read } for name="u:object_r:build_attestation_prop:s0" dev="tmpfs"
02-17 12:55:53.514 W main: avc: denied { read } for name="u:object_r:build_attestation_prop:s0" dev="tmpfs"
02-17 12:55:53.514 W main: avc: denied { read } for name="u:object_r:build_attestation_prop:s0" dev="tmpfs"
02-17 12:55:53.514 W main: avc: denied { read } for name="u:object_r:build_attestation_prop:s0" dev="tmpfs"
02-17 12:55:53.422 W ch.protonmail.android: ART APEX data files are untrusted.
02-17 12:55:53.582 W binder: avc: denied { read } for name="u:object_r:qemu_sf_lcd_density_prop:s0" dev="tmpfs"
02-17 12:55:53.582 W binder: avc: denied { read } for name="u:object_r:qemu_sf_lcd_density_prop:s0" dev="tmpfs"
02-17 12:55:53.674 W tonmail.android: avc: denied { search } for name="/" dev="cgroup2"
02-17 12:55:53.674 W tonmail.android: avc: denied { search } for name="/" dev="cgroup2"
02-17 12:55:53.674 W tonmail.android: avc: denied { search } for name="/" dev="cgroup"
02-17 12:55:53.674 W tonmail.android: avc: denied { search } for name="/" dev="cgroup"
02-17 12:55:53.766 W pool-8-thread-1: avc: denied { read } for name="version" dev="proc"
02-17 12:55:53.865 W WindowOnBackDispatcher: OnBackInvokedCallback is not enabled for the application.
02-17 12:55:53.865 W WindowOnBackDispatcher: Set 'android:enableOnBackInvokedCallback="true"' in the application manifest.
02-17 12:55:55.432 W InteractionJankMonitor: Initializing without READ_DEVICE_CONFIG permission. enabled=false, interval=1, missedFrameThreshold=3, frameTimeThreshold=64, package=ch.protonmail.android

0xC0DED0D0

Hm, full Proton suite on 9a with no issues here.

mazenetic
https://proton.me/support/android-keystore-issues

This is due to flawed implementation of the Android Keystore API by OEM manufacturers.

I'd think Pixels and AOSP (including GrapheneOS) would be the least affected by this, if at all!

One thing I'm sure of, though, is that Proton apps aren't dependent on Google Play services, so that shouldn't be the issue.

mazenetic I was able to replicate the issue on 9a and 9 pro fold with the latest stable GrapheneOS on both.

So this happens after a reinstall? Are you sure another reinstall doesn't remedy it, then? 😛

What if you were to try installing the apps in another profile, just for troubleshooting purposes? Still the same issue?

fid03

mazenetic And when you "reinstall", you are not restoring the app via Seedvault (the backup system that's included in GrapheneOS)?

MotherShipton

I have a Pixel 9a and use the Protonmail app with no issues. I did not get the error message described in the Proton page linked

d_buster

Nope, I have Bridge, Drive, Mail and Pass installed as separate apps and don't have any issues.

mazenetic

I had no issues at all until December when I did an app uninstall and reinstall. I was able to replicate the issue on 9a and 9 pro fold with the latest stable GrapheneOS on both. I have been in the Proton support queue for over a month. They are great, but I'm definitely stuck. I can log into the Protonmail web version without issue. Hoping they find something without saying it's the OS or the Sandboxed Google Play Services. The only thing I haven't tried yet is a wipe and clean install, which I'm trying to avoid.

mazenetic

0xC0DED0D0 So this happens after a reinstall? Are you sure another reinstall doesn't remedy it, then?

I did an uninstall and reinstall of Protonmail a dozen times including clearing storage with the same result.

0xC0DED0D0 What if you were to try installing the apps in another profile, just for troubleshooting purposes? Still the same issue?

Good idea. I created a new profile, installing Protonmail from Owner. I tried logging in first without Sandboxed Google Services, then clear storage and log in again with Google Services. Same result.

fid03 And when you "reinstall", you are not restoring the app via Seedvault (the backup system that's included in GrapheneOS)?

I did a storage clear, Uninstall, then fresh install from Play Store. I even tried the beta version on Play Store and the one on github https://github.com/ProtonMail/android-mail/releases

0xC0DED0D0

mazenetic Whole situation is quite serious, then. 🤔

It does sound like Proton is the only hope, at this point. It could be that the Keystore handler is overzealously trying to compensate for known issues, and has instead ended up creating an entirely new one on its own!

Again, I find it hard to believe that Pixel + GrapheneOS would be affected by a "known OEM issue". This is pretty much the Android reference, and not a "Samsung/Xiaomi-type of deal"...

So with that said, there's ample chance for Proton to remedy their bug (if it is theirs).

One additional benefit of GrapheneOS is the availability of system logs. You posted a snippet above, but did you send Proton the complete app runtime logs? Who knows, it might help...

Also, this thread itself might help spread awareness so your ticket gets handled.

mazenetic

0xC0DED0D0

I did send Proton some logs when I opened the support request with them. I've only been talking to their customer support and not any actual developers, because there has been no material feedback, instructions, or request for additional information. Based on the duration of time, my sense is that it is something real that they are looking into.

I would be curious to see of anyone setting up a new device is able to install and log into Protonmail successfully. When this happened my first instinct was that it was the phone (9 pro fold), so I tried it on my backup GrapheneOS device (9a) by uninstalling and reinstalling Protonmail and same thing happened! I also did a password reset on Proton and that did nothing. Note that all other Proton apps and services are fine, and as mentioned, I can log into Proton email via web browser and desktop app without issue.

If this is real and affects any new install on the latest GOS - this could become a longer thread. Hoping that is not the case, and this is some anomaly affecting only my account.

MotherShipton

Where are you downloading the app from? I've always used Obtanium to download the app direct from Proton and have it in a profile with no Play Services. I've used the app on a 6a and now a 9a with no issues

https://protonapps.com/protonmail-android

mazenetic

MotherShipton Primarily I've downloaded from the Play Store, but I have tried the version at that link. I have successfully run Protonmail for a long time on 3 different GOS devices with no problem. It was only from 26 Dec 2025 that I had an issue after an uninstall and reinstall of the app.