Should I disable child process restrictions in developer options?

PleaseBeKind

Android 12 started limiting and killing background child processes to improve performance and battery life by preventing reckless apps from using excessive cpu power. But genuine apps like Termux, which need this for functionality started suffering as a consequence.

People complained . So, starting with android 13, you can now disable this feature in developer options.

I want to run a linux vm on my phone for fun. But everytime I run a vnc server on termux, it get's terminated by the os in the time it takes to change my desktop wallpaper.

Internet tells me to enable the "Disable child process restrictions" toggle in developer options. But I'm not going to do it if it affects the security of my device.
Intuition tells me that apps evading os monitoring of their background processes may make my phone somewhat insecure. But I can't find anything about that on the internet.

What should I do?

Fay_Wilmont

At first glance, I'd say it only affects battery life, not security (compared to having developer options enabled and not changing the setting).

Intuition tells me that apps evading os monitoring of their background processes may make my phone somewhat insecure.

But they aren't evading anything..? Instead, you're telling the OS not to restrict the amount of them.

PleaseBeKind

Fay_Wilmont Instead, you're telling the OS not to restrict the amount of them.

Here's a snippet from this article.

According to agnostic-apollo’s article Phantom, Cached And Empty Processes, on Android 12 a new mechanism was added for Android system to monitor forked processes by the apps. They were named “Phantom processes”. And DEFAULT_MAX_PHANTOM_PROCESSES (default=32, all apps combined, not per app) defines how many processes are allowed to run before got killed by the system.

If you're right, then the os does not abandon monitoring any phantom processes but lifts the restriction from 32 to infinite (or a bigger number). And that the purpose of restricting them is not security but is strictly resource management.

But It may also be the case that the os does actually abandon monitoring these processes and they persist even after you exit the app until the phone is rebooted. My gut tells me that this situation could work in favor of a malware, making my device vulnerable.

In all honesty, I don't know which is the case. I've looked all over the internet but nobody is talking about it. People simply tell you to flip that toggle when termux doesn't work. They don't discuss the security implications of it (if any). I'm torn.

Upstate1618

Firstly are you sure the option would make it work? Maybe you can try Terminal instead of termux?
Secondly if you really want to toggle the option, i think you can give it a try. Do not touch any other developer options and disable Developer Option after you disable childhprocess restriction.

PleaseBeKind

Upstate1618 Firstly are you sure the option would make it work?

I always get a "signal 9" error when the OS terminates the vnc server in the background.

This article says:

Now, find the option called “Disable child process restrictions“ and enable it. This will solve your Termux error [Process completed (signal 9)] on Android 14 or higher devices.

And this article says:

For Android 14+ devices: Open Settings → Developer Options → Disable child process restrictions. Reboot. Then you are good to go.

Given the timeline of android restricting phantom processes in Android 12 , people complaining that termux doesn't work, talk of google launching a disable option in Android 13 and solving termux problems, and many articles and youtube videos telling you that "signal 9" error can be solved by disabling child processes in developer options in Android 14+ , I'm 99% sure that it will work.

Upstate1618 Maybe you can try Terminal instead of termux?

I didn't know about the terminal. Is this native terminal app basically the same as termux? Will it run the same commands and is it compatible with all apps that termux is compatible with? I guess I could try the terminal and report back here.

Upstate1618 Secondly if you really want to toggle the option, i think you can give it a try.

I could, couldn't I! And I know that you're telling me to be very careful and precise, try it once, and turn the toggle back off once I'm done. And I do really want to do it. But I'm worried and don't want to rush a decision before I know for sure that it's harmless from a security point of view.

Fay_Wilmont

PleaseBeKind I think https://github.com/agnostic-apollo/Android-Docs/blob/master/en/docs/apps/processes/phantom-cached-and-empty-processes.md should answer all of your questions.

Upstate1618

PleaseBeKind
Terminal is a Debian vm built in to the gos. Unlike termux, it's a real virtual machine.
https://www.zdnet.com/article/how-to-use-the-new-linux-terminal-on-android/
Terminal can be used with developer option disabled after first setup. I suggest you to

Enable Terminal and try it. Remeber to disable Developer Options afterwards.Terminal cannot be used with VPN lockdown currently.
If terminal doesn't meet your need, you could try disabling child process restriction.

PleaseBeKind

Fay_Wilmont
Hey! Thanks for finding that article for me! Unfortunately, it's too technical. I'll have to spend a few days wrestling with the jargon to completely understand it.
That said, I did read the part about the "risks" associated with disabling the child process restrictions:

What are the risks with disabling phantom process killing?
Users may want to know if there are any risks in setting the value to 2147483647. I don't see any in my limited view, specially considering that no max limit was defined by android devs during the commit, but they may not have considered someone setting a value this high. But then again, there was no limit in any previous android version, so only additional useless book keeping of phantom processing would just be occurring and battery drainage consistent with older android versions. If there is something I am missing, it would be great if someone pointed it out.

They mention no security risks. So I guess it's hunky-dory?

Upstate1618

Before using Terminal pls read https://github.com/GrapheneOS/os-issue-tracker/issues/7937

PleaseBeKind

Upstate1618

Terminal app has unrestricted storage access
#7932

Does that mean the native terminal app is not as sandboxed as a third-party app like termux (at least in terms of privileged access to system storage)? I guess that's why it's experimental.

If true, Termux does a better job of file transfer between the VM and your phone as it hooks into the native files app allowing you to move or copy chosen files from Android Folders to the VM folders and vice versa without granting it "All File Access" or running any command in the terminal at all.

I actually did try it out though, thanks to your suggestion. But it kept crashing on me. At first I thought it was because it needed "DCL via storage" and "Native code debugging" permissions because termux couldn't work without those either, but I quickly found out that I couldn't grant it those permissions if I wanted to because it's technically a system app and those permissions are restricted and unchangeable for all system apps.

I tried disabling my VPN but that didn't help either.

In the end, I had to give up on it. But now, with privileged permissions in mind, I might not try it again until it's updated to stable. Thanks a lot for sharing that.