Google Camera w/o G-Services and KeepassxDC w/o Storage Permission

MountFX

Hello!

I just installed GrapheneOS (Pixel 5) and have noticed two weird things.

I have seen, that Google Camera should need the Google Services to function. However, I have just installed Google Camera and it just works.
I have the app KeePassDX. For other Apps I needed a permission to e.g. access images in a certain folder. However, KeePassDX can access everything without any permission. I.e. it can access the ".kdbx" file in my "Documents" folder, although it has not a single permission assigned. This looks extremely strange to me. Other apps like Signal asks for permissions to access a certain folder.

Can someone explain this behaviour to me? Thank you!

Edit: Changed naming of Keepass.

Posichronic

https://grapheneos.org/usage#storage-access

"Without any storage permission, an app is allowed to:"

"create files of any type (both media and non-media) in Documents/ and Download/"

MountFX

Posichronic Oh, ok. Thank you! Good to know!

matchboxbananasynergy

MountFX Google camera no longer needs anything to work. It used to need GSF, but no longer does in GrapheneOS.

EndlessWay

matchboxbananasynergy Does it neither need Camera Service Provider? That'd be great!

grapheneman

i have installed Google Camera but wanted to use with Storage Scopes, so i created a folder to lock it down there, however the app crashes this way. Looks like Google Camera wants to see your default folders. Is there any workaround to make it work without allowing Location and real storage folders?

matchboxbananasynergy

grapheneman Google Camera should work fine with Storage Scopes, and it doesn't need location.

If you give it Storage Scopes without adding any folders to that, it should save photos/videos to DCIM/Camera.

matchboxbananasynergy

EndlessWay It doesn't need anything. Base Google Camera functionality works out of the box. Some optional things like AR features need full blown Play Services, as expected.

Relevant change that makes this possible can be found here: https://grapheneos.org/releases#2023040400

add generic compatibility shim catching the exception from the Gservices provider being missing to enable apps like Google Camera and the Pixel eSIM firmware app (Google eSIM activation app is separate) to work without GSF installed since they don't have any actual hard dependency on either GSF or Play services

Gcam Services Provider is pretty much obsolete for GrapheneOS at this point.

MountFX

After thinking about for a while, I still do not get it really.

I have app "Simple Gallery". I can restrict the access to certain folders (using Storage Scopes) for this app after it asks me for permissions. E.g. it loads images only from DCIM/A for example.

Then I have the app e.g. KeepassX, which can open any file in DCIM without asking for permissions. I also can not restrict the access for this app.

This does not make sense to me? My goal is e.g. that I have a KeepassX ".kdbx" file and only KeepassX (and mayby a few necessary system "apps" / root) have access to it.

de0u

MountFX Then I have the app e.g. KeepassX, which can open any file in DCIM without asking for permissions.

I believe if you consult the KeepassX source it will turn out that the file-picker window pops up because KeepassX asked the file picker to pop it up. Then the file picker asked you which file you wanted to authorize (or none).

matchboxbananasynergy

MountFX What is likely going on is that your KeePass app is bringing up the file manager and allowing you to choose a file that it can then see and access. When you see the file manager interface, that does not mean the app has access to all these files, only then file/folder you select through that interface.

MountFX

Thank you! That makes sense!