Install apps from secondary profile to owner without ADB?

Ignorant_Cormorant

I don't mind having Google Play Services in the owner's profile, but I'd like to keep it logged out of any Google account.

However, I'd still like to be able to push apps to secondary profiles, which requires them to be installed in the owner's profile first.

I also want to keep Google Play as the installer, so I'm not interested in using Aurora Store or sideloading APKs.

So given I installed them in a dedicated secondary profile, is there any way to install them to the owner's profile without relying on developer options and adb shell pm install-existing --user 0?

Johnnyloans

Ignorant_Cormorant

Greetings, the second half of this comment has advice for your concern

https://discuss.grapheneos.org/d/33786-changing-ownership-of-apps/5

EverettHitch

Ignorant_Cormorant why don't you just disable Google Play (disabled apps don't run) in owner profile and push it to secondary profile as any other app. I haven't done so since I never use GrapheneOS in this way but don't see why it wouldn't work.

Murcielago

Ignorant_Cormorant

So given I installed them in a dedicated secondary profile, is there any way to install them to the owner's profile without relying on developer options and adb shell pm install-existing --user 0?

It's currently not supported for security reasons:

As of now, it is only one direction: from owner to secondary profiles.

source: https://discuss.grapheneos.org/d/23772-can-i-enable-apps-of-a-user-profile-to-be-used-in-the-owner-profile

and

It [pushing an app from the other profile to the Owner] is not currently supported for security reasons. An actual additional user using the device via a separate profile could install a malicious app and the Owner user would have no way of knowing that happened.

source: https://discuss.grapheneos.org/d/4842-app-tracking/6

DohnJoe

Ignorant_Cormorant

Having a read here, it seems that this "permission" would actually allow you to install app from other users/profiles, but as far as I know, there is no application that asks for Manager permissions and allow you to install apps from other users/profiles.
Also, I guess we cannot take for granted that this permission can actually have a look on the apps installed in the private space.

I will be happy to be proven wrong, of course, as this would solve the problem of some people, even if I would personally decide for a different approach.

Overall, giving so much trust to a single app just to install another, seems a little bit excessive to me.
Johnnyloans gave a link to 2 possible solutions.

Ignorant_Cormorant

Well, that would change the package installer which contradicts my requirement.

What I was thinking was whether it would be possible to write an app and grant it permission (as a one-time action) to subsequently execute pm install-existing.

Ignorant_Cormorant

EverettHitch

Could you explain what you mean?

Ignorant_Cormorant

Sorry if my question wasn’t clear. I know the limitation, which is why I use ADB.

Can this be optimized so debugging isn't constantly enabled?

Or could apps be re-installed but retaining the package installer value.

Ignorant_Cormorant

For example, wouldn't an app promoted to Device Owner via DevicePolicyManager be able to call installExistingPackage()?

Is GOS different to AOSP in this regard?

Johnnyloans

Ignorant_Cormorant

I think only adb can transfer a package or install one while editing the source.

I know nothing about the shizuku app, but ive seen people speak about it performing operations that, to my knowledge, only adb could do. Maybe it can perform what you want.

Ignorant_Cormorant

DohnJoe Overall, giving so much trust to a single app just to install another, seems a little bit excessive to me.

You mean you wouldn't trust an app which you wrote yourself, compiled yourself, signed yourself, installed yourself, and granted it the required permission?

DohnJoe

Ignorant_Cormorant

In that case I would, of course.

However I am suggesting that writing, compiling, signing, installing and configuring an app (if installExistingPackage works as we think it works) is much more work than using a single adb command (you can always close Developer Options once you are done) or installing an app in the owner profile and disabling it.

The installation will be one time only, the updates will be pushed automatically by the system.
I think it's too much trouble to write an application so sensitive just to install an apk.

Also, if you follow the aforementioned link, you will find people suggesting other solutions, like cloning the apk (or the set of apks), which is still faster than writing your own app.