Setup concept for higher privacy, security and easy maintenance

overflow

I am still new to GrapheneOS and use the multiuser feature:

Admin: With this I never log in
Finance: Here are my apps for banking etc.
Work: Here are apps for work
Private: This is my personal account with some apps

In the Finance account I have installed the Google Play services so I can use my banking apps.

If I want to install apps from the Playstore in my private or work area, I have to install the Google services in the accounts. This takes up a lot of memory and I don't feel comfortable with it.

My question is: Is it possible to install the Google services in a separate account (sandbox) and provide the apps installed there on the desired user account.

In addition, I would like that when I boot my system default login with my private account. The admin account should not be used.

Every time I create an account, I have to configure the settings of the new account. Is there some kind of template configuration ?

[deleted]

overflow In addition, I would like that when I boot my system default login with my private account. The admin account should not be used.

Giving the GrapheneOS website a read through is highly recommended and suggested. It's caulk full of useful and important information.

"The owner profile is special and is used to store sensitive system-wide operating system data. This is why the owner profile needs to be logged in after a reboot before other user profiles can be used. The owner profile does not have access to the data in other profiles."

https://grapheneos.org/faq#encryption

treequell

overflow My question is: Is it possible to install the Google services in a separate account (sandbox) and provide the apps installed there on the desired user account.

Yes, but only if you install Google Play Services in the owner profile. Use the install available apps feature in Settings to install apps in your required secondary profile. You can keep the app disabled in your owner profile if you wish, and still update it across user profiles from Google Play Store in the owner profile.

overflow Every time I create an account, I have to configure the settings of the new account. Is there some kind of template configuration ?

You might be able to achieve that by backing up an empty user profile with your required configuration as a template using Seedvault, and then restoring that backup when you create a new user profile. I've not tested using Seedvault in this way though.