What special permissions do Google Play Services have on non-GOS phones?

OpenSource-Ghost

GOS umakes sure Google Play Services runs in a sandbox and doesn't have any special permissions, just like any app on GOS.

What special permissions do Google Play Services have by default on non-GOS Android? What info can Google obtain through Google Play Services on typical phones that it can't obtain from GOS phones?

Andy

OpenSource-Ghost What info can Google obtain through Google Play Services on typical phones that it can't obtain from GOS phones?

Any simple web search that does not use google = Tor DuckDuckGo = thousands of hits.
So let us limit search for this years hits starting with….

https://www.thesun.co.uk/tech/18204648/google-play-warning-apps-android-security-risk-hidden/

Perhaps a little history would be useful…?

https://www.linkedin.com/pulse/data-privacy-google-what-security-risks-mohammad-mo-nilforoushan

Or…

https://www.businessofapps.com/news/75-of-indian-apps-on-google-play-pose-security-risks/

https://www.androidpolice.com/google-play-protect-vanced-manager-app/

List of problems is endless – that’s why I am using Graphene-OS without Play Store.

MetropleX

OpenSource-Ghost

Automatic app updates
Core OS components built by Google now ship via the Play Store through APEX components (also known as mainline modules or Google Play system update)
Custom SELinux policy
Privileged permissions and configuration for the OS setting Play services as the provider for various APIs (ie granting itself location permissions to use Play Services Contact Tracing API)
Whitelisted Capabilities (Can restart itself if Force Closed, Enable itself if disabled etc etc)
The ability to bypass profile isolation and communicate / perform actions across profile

Just a brief run down and not exhaustive but all the excesses and invasive access to such things are all revoked under GrapheneOS.

[deleted]

OpenSource-Ghost What special permissions do Google Play Services have by default on non-GOS Android?

You should check the manifest of Google Play services (com.google.android.gms, Google services Framework (com.google.android.gms), Google Play store (com.android.vending), ConfigUpdater, Google Backup transport and other Google system components to see every single permission they have.

For custom SELinux Policy called gmscore_app of Google Play services/Google services Framework (both share the same UID), you can check here: https://android.googlesource.com/platform/system/sepolicy/+/master/private/gmscore_app.te

OpenSource-Ghost

I wasn't talking about Google Play Store, but Google Play Services (also known as Google Mobile Services) that run at the heart of typical Android phones and by default have special access to phone hardware, as well as, provide a lot of telemetry to Google about your device. I wanted to know what those special permissions are and what info GOS prevents Google from obtaining from GOS phones with Sandboxes Google Play/Mobile Services.

Andy

OpenSource-Ghost I wasn't talking about Google Play Store, but Google Play Services

I was not aware that closed Google users had one without the other so was trying to make you investigate for yourself the risks of interdependent cross permissions needed to use commercial Google. Don’t start me on the huge multi billion fines imposed on Google!
Hope you took heed of the risks I linked? Dread to think of the total tally..!

MetropleX has kindly given you the short answer on specific invasive access permissions revoked by Graphene-OS – Just the reason to ditch closed commercial Google and install GOS. I did not need persuading – I used to spend hours denying this and that permission on standard phones with bundled apps; now with Graphene-OS I barely need to lift a finger. Cheers to Daniel and his GOS team