• General

  • App Manager and his mighty magic

I follow the advise to open new threads here we go

WhoTheFuckisAlice The App Manager is indeed a very powerful tool that I will use furthermore, but I will not try anymore to deactivate the standard keyboard, thats for sure.

What about the blocking function of trackers of the App Manager, if I want to "mute" the necessary apps from the Playstore that I will/must install in future?
The blocking would be performed immediately after installation via Intent Firewall. Is this intervention also a security risk for GraphenOS? What possibilities are there in GraphenOS to interfere with the target addresses of the built-in trackers included in Auora/Playstore apps?

Is it possible to root GraphenOS, make certain changes and then undo the rooting?

I thank you in advance for the competent answers!

https://discuss.grapheneos.org/d/8070-how-to-solve-a-no-keyboard-issue/17

      • [deleted]

      • Post #2
      • Edited

      WhoTheFuckisAlice What about the blocking function of trackers of the App Manager

      Since "App Manager typically blocks application components (or tracker components) using a method called Intent Firewall (IFW)", Tracker blocking via App Manager will not work without giving root access to App Manager, which requires rooting your OS.

      WhoTheFuckisAlice Is this intervention also a security risk for GraphenOS?

      Yes, It is a security risk. You don't want normal apps disabling components of other apps. An runtime/Special access permission can be made for this purpose which let's the user grant it to the app they trust, but I think GrapheneOS will NOT implement this on its own, because its too cumbersome, prone to error and just not worth It. So you will have to create an issue on the AOSP issue tracker for this, but they'll pretty much reject your request.

      WhoTheFuckisAlice Is it possible to root GraphenOS, make certain changes and then undo the rooting?

      It is quite possible, but will require an unlocked bootloader. I also think help regarding Rooting cannot be given here.

              [deleted] The app manager will do the job without root, it can use wireless debugging to block these trackers. You can download the app from F-Droid and take a look, I think the developer knows what he is doing, you just have to look in his manual, he explains everything.

                  • [deleted]

                  • Post #4
                  • Edited

                  WhoTheFuckisAlice Blocking apps' components via Shell (ADB) is not great, since apps have full control over their own components and can enable/disable them. The only way to make sure that apps cannot enable their blocked components, is to use Intent Firewall (IFW), which requires being able to write to the system partition.

                    WhoTheFuckisAlice I would absolutely not recommend using wireless debugging for anything like that. Judging by this and other posts here, you seem to be used to using Android in a way that's highly insecure which you may not realize.

                    I would highly suggest using the device as it is intended to be used instead of looking for hacky workarounds and root.

                    We do not support, recommend or endorse root or any similar methods in this forum, and would rather they not be a topic as well. I hope you understand. :)

                        matchboxbananasynergy I would absolutely not recommend using wireless debugging for anything like that. Judging by this and other posts here, you seem to be used to using Android in a way that's highly insecure which you may not realize.

                        I would highly suggest using the device as it is intended to be used instead of looking for hacky workarounds and root.

                        We do not support, recommend or endorse root or any similar methods in this forum, and would rather they not be a topic as well. I hope you understand. :)

                        Then tell what is this unsecure of my behaviour when I modified firewall rules? If App Manager do his job and after this I change his working mode back to non root and delete the wireless debbuging code. System Partition is modified and I am aware of this trackers.
                        I understand that u will not support root etc. because it can be a security problem, but that is too generalized for me, that is not an answer you can given people searching so long after a really secure android, they want more.
                        You must change the behaviour of the Apps to be on safe side but only less permission will not do a perfect job.
                        If you dont like my personality to ask everything, because the topic is not to discussed without explanation, then do your job. delete my topics or block me out here.

                        [deleted] Yes, It is a security risk. You don't want normal apps disabling components of other apps. An runtime/Special access permission can be made for this purpose which let's the user grant it to the app they trust, but GrapheneOS will NOT implement this on its own, because its too cumbersome, prone to error and just not worth It.

                        Yes, that's exactly what I want to do, and the app is one of the best tools I've seen in the last 10 years, which is why I'm going to do it. Because unfortunately there isn't always a FOSS alternative out there for everything, take the banking apps or certain music services, or old favorites that you bought but don't work without Playservice. Why do I have to put up with the spying of any company? GraphenOS has a very good possibility to offer PlayService in the sandbox, but the trackers in the apps remain. With the IPs transmitted they do movement profiles or tracking in the network makes possible. This can be done very easy with firewall rules right? So why not?
                        And if the system partition will be the "original" after reboot, no prob App Manager has a Profil option so it will take only a few seconds to patch all right again.
                        Security is a whole concept of a lot of things.

                        I would like to work without root and use a VPN for network filtering, but since every android I've tested so far has the restriction to use only one VPN and SSL tunnels are only possible through routing (which is not possible without root) you have no choice.
                        Maybe here would be an option of GrapheneOS to "intervene" Tunnel for all please :D

                              WhoTheFuckisAlice

                              I would like to work without root and use a VPN for network filtering, but since every android I've tested so far has the restriction to use only one VPN and SSL tunnels are only possible through routing (which is not possible without root) you have no choice.

                              You do have a choice. I use v2ray as the primary VPN on my GOS and in its clients (which is completely FOSS) there is a routing option here that actually offers even more functionality than root-based firewall solutions, such as blocking domains by regular expression.
                              s

                              It even has a feature to use two or more VPNs at once, which you called impossible! The client supports not only v2ray tunnels, but also proxies, SSH, Wireguard and more, which can also be layered on top of each other.
                              At first I too thought I would miss the features I was getting from the custom firmwares with root privileges I used for years, but that turned out to be false when I switched to GOS.

                                  WhoTheFuckisAlice It sounds as if your needs might be best addressed by forking GrapheneOS and building your own Android variant. The GrapheneOS project provides directions on how to do this (please be sure to remove the GrapheneOS branding and specify a different update server; also, please don't seek advice about a custom variant on this forum - probably it would be better to contact the developers via Matrix).

                                  Another option might be joining the development team.

                                  Please note that I do not speak for the GrapheneOS project.

                                      de0u Sorry, all I can do is to do point on it...i can not code but I have an idea how software works and how to use it. For me it is every time the same, finding, talking about experience, waiting for changes and doing the best with the given...

                                      fl1pper You do have a choice. I use v2ray as the primary VPN on my GOS and in its clients (which is completely FOSS) there is a routing option here that actually offers even more functionality than root-based firewall solutions, such as blocking domains by regular expression.

                                      thx a lot, i will have a look, that would be great if one problem is solved with this option.

                                          fl1pper You do have a choice. I use v2ray as the primary VPN on my GOS and in its clients (which is completely FOSS) there is a routing option here that actually offers even more functionality than root-based firewall solutions, such as blocking domains by regular expression.

                                          It even has a feature to use two or more VPNs at once, which you called impossible! The client supports not only v2ray tunnels, but also proxies, SSH, Wireguard and more, which can also be layered on top of each other.
                                          At first I too thought I would miss the features I was getting from the custom firmwares with root privileges I used for years, but that turned out to be false when I switched to GOS.

                                          Hi again @fl1pper, can you please link me this special client, I did not find something like that or what I searched, only v2ray as a plugin for Sagernet and this App I did not understand, how I can use there Tor VPN, Ipsec VPN and Netguard as VPN on one maschine. Documentation is also very poor or not easy to find. So can u please offer me some more informations please?
                                          I did not need possibility for proxys, here I use the App connect bot, this is easy and stable like a rock. Thx for your help!