Deny admin priviledge for default User?

Grafene

Hello,

Newbie to GrapheneOS.

I want the main user to not be able to install apps or do any system administration. The main user would not have access to the administration account.

Is this achievable with the multiple user profiles in GrapheneOS, or is there another solution?

[deleted]

May I ask what exactly are you trying to achieve?
If main user wouldn't be able to install any apps, would be there any profile with "admin" access?

Grafene

Thanks for the reply,

I would like for the user(s) of the device to not have permission to administer the device: Install/Remove Apps, Update System, Manage users, etc.

Ideally there would be a seperate administrator account on the device that requires seperate credentials: As in linux the root account.

I added a second user profile in GrapheneOS. However after booting, GrapheneOS requires the administratior (main) account to be legitimized, before it is possible to switch to the second user profile. This is not the behaviour I was expecting.

In my case the second user profile does not have the credentials to the administrative account.

The result is that the device is not usable for any users that do not have the administor credentials after starting the device.

BluishHumility

Grafene Is such support planned/possible to implement in the future or present?

It is already supported. The only time the owner account needs to sign in is after the device is rebooted.

Grafene I would like for the user(s) of the device to not have permission to administer the device: Install/Remove Apps, Update System, Manage users, etc.

If this is the configuration you want, those users shouldn't need to reboot the device anyway.

[deleted]

Well, the main user is administrator.

But you can create another profile, and there you can deny any ability to install apps, or/and recieve calls etc.

Each profile has individual login credentials.

But it doesn't work in a way, that you would start a device and choose a profile, in your case that you would skip directly into non-privilege profile.

There are many threads about profiles and set up, and there is a section in grapheneos.org about it too.

You can find more information here:
https://grapheneos.org/features#improved-user-profiles

And you might be also interested in this:
https://grapheneos.org/faq#encryption

Grafene

Thank you for your reply 314random, the second link was informative:

"The owner profile is special and is used to store sensitive system-wide operating system data. This is why the owner profile needs to be logged in after a reboot before other user profiles can be used. "
....
"GrapheneOS enables support for ending secondary user profile sessions after logging into them. It adds an end session button to the lockscreen and in the global action menu accessed by holding the power button. This fully purges the encryption keys and puts the profiles back at rest. This can't be done for the owner profile without rebooting due to it encrypting the sensitive system-wide operating system data."

My understanding is GrapheneOS implementation of FDE limits the device to one person (owner). There is currently limited support of multiple persons on one device: After a reboot the owner must unlock the device before other persons may use the device; Alternatively the owner credentials are shared with all persons, so that they may unlock the device themselves, with the caveat of granting root access to all persons.

Ideally, after a reboot it would be possible for persons to use the device without unlocking the owner account. In this way multiple persons could share one device, without being dependent on the owner being present to unlock the device.

Use case a) One Device: teacher(owner), students (users)
Use case b) One Device: parents(owners), children (users)
Use case c) One Device: employer(owner), employees (users)
etc.

Is such support planned/possible to implement in the future or present?

Grafene

BluishHumility

Hello BluishHumility thank you for your contribution,

The problem lies there in that the device becomes unusable for the users, if the device reboots. The device could reboot in many circumstances: run out of charge, auto reboot feature after idle, system crash, turn off the phone to save battery, no phone policies that require phones be turned off in schools, embassies, airports, courts, etc.

The user is dependent on the owner to be present to enter the owner credentials. The owner could be on vacation for six weeks, or even a short recurring duration of 15 minutes would be a large inconvenience.

Have I described the problem clearly?

BluishHumility

Grafene Yes, I take your point. It does sound like the use case you want is not currently supported.

Graphite

This sounds like an "enterprise" use case.
You have "users" that will be issued phones, on which you don't want them to have all admin privileges.
You need what is called an MDM.

GrapheneOS doesn't support MDM at this time.
https://discuss.grapheneos.org/d/1841-ms-intune-company-portal-with-work-profile-not-working/

You could try to find a good App Locker program that is given device admin permissions, and can lock the user from accessing any settings. No guarantee that a clever user won't be able to bypass though.

Grafene

Perhaps a solution and/or implementation is encrypting the "sensitive system-wide operating system data"
with multiple keys: one for each user profile. This way a user could login and the decrypt the systems permission, as it currently works with the owner account.

mhall

Grafene I'm also looking to do the same thing as you. I hope they change this to allow a secondary user to log in on reboot.