Private Space not blocked from installing apps

Tandara

Greetings everyone!
I recently discovered that restrictions for the app installations imposed by the owner profile's user manager are not applied to the Private Space within them. Does anyone know whether this behavior is intentional or is it a current limitation of android?

It seems a bit risky if users are not aware of it. If user doesn't have a private space set to lock immediately, a malicious actor can install apps in PS to track the user without him ever noticing. The easiest path would be to take an unlocked phone and quickly download an app from the web with an icon pretending to be a default app. The user might not be able to tell it's installed and active without having PS unlocked and going into the PS battery stats.

userofgos

Tandara Does anyone know whether this behavior is intentional or is it a current limitation of android?

It is a current limitation of AOSP's Private Space implementation.

Tandara

userofgos Are there any plans on the roadmap to fix it? That's quite a miss

userofgos

Tandara Are there any plans on the roadmap to fix it?

Not that I'm aware of.

Johnnyloans

restrictions for the app installations imposed by the owner profile's user manager

Where is this option at?

Private space is separate profile similar to another user account which many people may not know and could be better communicated.

Private space does have restrictions for installing apps:
settings > apps > special app access > install unknown apps
At the top are tabs for personal and private--owner and private space respectively.

Every PS app has a key shield icon to not confuse owner & PS. To prevent on from believing the changes to 1 effects more than 1 instance.

Dumdum

Johnnyloans Where is this option at?

Settings > System > Users > (user profile) > App installs and updates

Johnnyloans

Dumdum

Oh, I see, thank you.
I wasn't aware that every profile can have a private space.

Must be an oversight since PS has a different profile # separate from the user.

The issue can be reported here:
https://github.com/GrapheneOS/os-issue-tracker/issues

userofgos

Johnnyloans I wasn't aware that every profile can have a private space.

It's been a feature since the 2025051900 GOS release

de0u

Johnnyloans The issue can be reported here:
https://github.com/GrapheneOS/os-issue-tracker/issues

There already is Issue 6066.

Please note that the GrapheneOS developers do not want posts to the issue tracker along the lines of "I want this too!" or "Is there an update?". The issue tracker is for posting information related to diagnosing a problem (not needed here) or for code pull requests. Other posts may cause the issue comments to be locked, or even perhaps cause the issue to be made private. It is fine to subscribe to an issue and/or to use the reaction emojis.

If an issue is personally very urgent, one way to move it forward would be to hire an Android developer to write some code and submit it. Depending on various factors, it might not be merged... but if the code is there then people can try it on a private fork of GrapheneOS.

The project historically does not allocate developer time via bounty voting, so suggesting that is very unlikely to result in forward movement.

Johnnyloans

userofgos de0u

I can always count on the homies to back me up with hard data.
Thanks.

After I sent my previous message, I did think: "oops, there could be an issue open already." I also found it peculiar to have many PSes on GOS.

Per AOSP documentation:

Private space can have only one instance on a single device, and can exist only for the main user (not for secondary users or within other profiles).

https://source.android.com/docs/security/features/private-space

A feature addition by GOS:

Private Space: add support for secondary users

https://grapheneos.org/releases#2025051900

The above GOS change seems to conflict with the comment on #6066:

Working as intended, upstream user restrictions for app installation only applies to the full secondary user, it doesn't apply to its nested profiles.

https://github.com/GrapheneOS/os-issue-tracker/issues/6066

The upstream intention was for no apps to install on a secondary user if configured to do so.
If another dev adds another avenue for app installation--private space--this would negate the original intention.

de0u

Johnnyloans I don't think there is any conflict.

My understanding is that the upstream single Private Space does not (at present) have an install-applications toggle; upstream, only regular/full secondary profiles have the toggle. Perhaps someday the upstream single Private Space will have an install-applications toggle.

My understanding is that the GrapheneOS change allows each regular profile (owner, secondary) to have a Private Space, and that these multiple Private Spaces, like the upstream single Private Space, don't have an install-applications toggle, so all of the Private Spaces are working as intended.

Issue 6066 has been re-opened, which suggests that the team is considering changing the behavior of Private Spaces. But honestly in this sort of situation often waiting a while results in Google resolving the issue upstream.