weird interaction with sensors permission for Google Play Services

Duct9143

I noticed that (on my Pixel 5), whenever I don't give Google Play Services the sensors permission, in Google Maps, the compass stops working. So instead of an arrow that points towards where I'm looking at, I now only see a dot.

So Google Maps ends up having access to sensor data even though I don't give it this access directly, but only through Google Play Services.

This now leads me to wonder: Is there possibly more leakage going on from permissions given to Google Play Services, especially with other Google apps, but also with other apps that simply have Google frameworks built into them? I'm also wondering this in regards to, for example, using Gboard without Internet permission, while giving Google Play Services internet permission.

Thoughts?

yore

Duct9143 I don't think Google Maps is very accurate without the Sensors permission. However you can always disable Play Services to prevent this type of communication. Google Maps relies on Play Services so you can revoke Network access instead and test if it works.

That being said, it's good practice to install such apps in separate profiles so that disabling Play Services or revoking Network permissions doesn't affect other apps that need it.

[deleted]

From the GrapheneOS Features Overview: "Apps within the same profile can communicate with mutual consent and it's no different for sandboxed Google Play." f you give Google Play Services Internet permission and have other Google apps installed, they can theoretically communicate with each other and let the app access the internet. Here is a similar Github Issue. As it stands right now, the only way to prevent mutual consent between apps is using different user profiles. IPC or mutual consent sandboxing is still not implemented in GrapheneOS but it is planned.

Duct9143

Does something important stop working if you take away the Network permission from Google Play Services? Is it needed for push notifications, for example?

[deleted]

Duct9143 Google Play services obviously needs the Network permission for notifications, as notifications are fetched from servers. And there are many other things for which Google Play services requires the Network permission, for example Signing in to your Google account in the whole user profile.

[deleted]

Duct9143 As @[deleted] said, many things depend on Google Play Services having network access so I don't believe that would be a valid solution. Google Maps doesn't need Sandboxed Google Play to work. You can install it from Aurora Store if that works for you and grant it sensors permission on its own.