Multiple Users - Could I Get Some Clarification?

nosferatu It's absolutely fine, don't worry about it. I'm happy to help. :)

Hi guys,
great question from @"nosferatu", great answers!

I can only add my experience with a few tips for beginners, who will read this thread later:
I am also a fan of Josh/Side of Burritos and have learned much about GrapheneOS from this smart guy!
But the GUI/menus of GrapheneOS and the way to install sandboxed Google Play Services has changed a little since the beginning and it looks completely different now if you compare it with Josh's great YT videos (1–2 years old).
That can confuse beginners a little bit, but it's no real problem.

– I use my owner profile clean (without Google Play Services).
– For banking apps and few other apps which need GSF I have a second profile named Google.
This profile I use not every day and for minutes only – check my bank account, use DHL app when waiting for delivery of a parcel, using “My o2” provider app by Telefónica sometimes to check for a better tariff plan etc.
Make a photo with Google Camera and watch/edit it thereafter with Google Photos, maybe use the eraser or crop the image. For GCam and Photos apps I have set the storage scope to camera path only: Main storage/DCM/Camera.

Two advantages of my setting:
– My owner profile is clean – no Google Play Services.
– I can save much energy (battery lasts longer) …
… because of having rarely used apps separated to a “Google-profile” I don't switch to owner profile after using it!
Instead I log off, so “sandboxed Google Play” does not have to run permanently in background, consuming energy…
Logging off makes the profile inactive so that none of the applications installed in it can be run. It also deletes the disk encryption keys from memory and hardware registers, returning the user profile to sleep mode.

In another thread of this great forum I read about no need for Google Play Services, when using GCam.
This needs a GrapheneOS update from April 2023.
I have tested it by installing GCam w/o permission for internet on my owner profile.
And because GCam needs Photos app as preview (!), have also installed Photos app w/o permission for internet.

Conclusion: works fine! GCam and Photos on owner profile with storage scope path: Main storage/DCM/Camera.

Eagle_Owl just a control question, do both your profiles use the same internet access points or different and do you use location services in any of them?

nosferatu

I recommend to study the website grapheneos.org, especially the menu Features. ;-)

Quote:
GrapheneOS provides Storage Scopes as a fully compatible alternative to the standard Android storage permissions. Instead of granting storage permissions, users can enable Storage Scopes to make the app assume that it has all storage permissions that it asked for. On Android, an app that doesn't have any storage permissions is still allowed to create files and directories, and is allowed to access the files that it created. Users can optionally add files and directories as storage scopes to permit the app to access files created by other apps.

For more details, see the usage guide section on storage access.

Long story short: Don't give apps permission to any directory. Give them Storage Scopes, instead.
Advantage: apps can only read & write their own written data, no others! Spying at other app's data is impossible!
For the most apps it needs only to activate Storage Scopes w/o giving them a special directory.
I recommend also to watch Josh's YT video https://www.youtube.com/watch?v=WjrANjvrSzw for this. ;-)

Eagle_Owl In another thread of this great forum I read about no need for Google Play Services, when using GCam.
This needs a GrapheneOS update from April 2023.
I have tested it by installing GCam w/o permission for internet on my owner profile.
And because GCam needs Photos app as preview (!), have also installed Photos app w/o permission for internet.

Conclusion: works fine! GCam and Photos on owner profile with storage scope path: Main storage/DCM/Camera.

I just tried to sideload Google Photos but it complains :

"Operation completed with errors

Google Photos_6.68.0.600535764.xapk

1 INSTALL_FAILED_NO_MATCHING_ABIS:

INSTALL_FAILED_NO_MATCHING_ABIS:

Failed to extract native libraries, res=-113

2 App not installed"

(latest build feb 2024 android14)

May I ask from where you installed it ? Aurora ? May I ask app version that works with which build release?

graphenediscoverer4 Failed to extract native libraries, res=-113

This sounds like maybe the APK was built for a different architecture than the device -- for example, it's a 32-bit ARM binary being installed on a 64-bit device.

Specifying the URL of the APK that didn't install and the model of the device that the install failed on would be good.

Also it would be good to specify the GrapheneOS build string from Settings, About phone, Build number.

Each profile has a separate VPN slot, so you can even use different providers in different profiles.

Thanks for the info on something I didn't even know about.