add automatic installation of play apps into work profile #147
Conversation
|
New, simpler approach. No custom permissions, no custom apis In InstallStart when installing apps it checks if play store is genuine google play store and the user is a work profile and skips the DISALLOW_UNKNOWN_SOURCES restriction DevicePolicyGmsHooks runs after device policy manager creates the profile and installs store + services and gives the store permission to install packages (REQUEST_INSTALL_PACKAGES) (only if the managing app requires play services) |
mkg20001
force-pushed
the
gapps-work-profile-new
branch
2 times, most recently
from
65c24ec to
6090d44
Compare
|
I remember last time I was told the play store installation shouldn't happen in DevicePolicyManagerService as it has too many permissions I need the installation to happen just before the device policy app is installed and gets any intent, as it may crash due to lack of play services. I'm none the wiser on how to do that securely and I'd appreciate some guidence if possible |
|
Absolute legend mate, thank you so much for continuing to develop and push this! |
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
6090d44 to
b7c9a88
Compare
thestinger
force-pushed
the
15-qpr2
branch
5 times, most recently
from
5f3142f to
8edf282
Compare
thestinger
force-pushed
the
15-qpr2
branch
10 times, most recently
from
3ec1472 to
ccaf1e6
Compare
How do we know the managing app requires play services? For example, Microsoft Company Portal requires it to set up the work profile. Will this change support that use case? |
See 437b272#diff-d0c4fee5a9bb21d19df9696c4428b8053d7842e0e3fde3356fd4bdc335666548R33 |
thestinger
force-pushed
the
15-qpr2
branch
3 times, most recently
from
44f6627 to
c0c2721
Compare
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
b7c9a88 to
bdfe2c2
Compare
thestinger
force-pushed
the
15-qpr2
branch
2 times, most recently
from
1e77b17 to
acd9811
Compare
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
bdfe2c2 to
006d02d
Compare
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
006d02d to
b45559b
Compare
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
b45559b to
4778e63
Compare
|
Stopped working on android 16, need to find a fix |
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
4778e63 to
0742a64
Compare
|
new issue, play store is not being copied. |
thestinger
force-pushed
the
16
branch
2 times, most recently
from
3a3da14 to
b8ebc93
Compare
|
This would fix a lot of issues lol |
|
Hi just checking, are there plans to merge this yet? Thanks |
|
This is currently broken and i have no resources to update and fix |
What?! Please noo. :'( |
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
0742a64 to
19dcbdc
Compare
|
@muhomorr I don't have the skill to comply with your requirements and I'm not sure I have the mind for fixing this up. You could look into this, all it essentially does is copy the play store / framework with installExisting and add a special exception to the policy of unknown sources when the work profile app has a play services dependency |
I am happy to help if you catch me up a little bit. This would solve the only reason i still have a stock android device - for a work profile |
When setting up a google-managed work profile, GmsCore tries to install the Android Device Policy app For this to work REQUEST_INSTALL_PACKAGES permission needs to be in it's manifest
…nto work profile Currently when creating a work profile with a DPC app that requires play services, the DPC app expects play services to also exist on the work profile Since play services aren't global on GOS, this patch automatically installs them into the work profile Whether an app requires play services is automatically detected Because this needs to happen before the DPC app is triggered in any way in the work profile, this needs to be part of the profile creation itself.
When a work profile with play services gets created Play Store can't install any apps as the work profile may have a policy active to forbid unknown sources as it is not aware that play store is not a system app and gets blocked by that policy. Here we detect if the play store is genuine and is trying to install an app in a work profile. If that is the case we allow it to proceed, despite not being a
mkg20001
force-pushed
the
gapps-work-profile-new
branch
from
19dcbdc to
4279d22
Compare
The issue is essentially I'm cloning an instance of something by passing it as a parameter which should not be cloned here https://github.com/GrapheneOS/platform_frameworks_base/pull/147/files#diff-d46ea51799b3e1771bedb5697d2aecdbac71731196b92aafb056154cda6b3927R22120 The other issue is that there are review comments on the old PR about security and how this should be improved that I just don't have the time/energy to look into as android development isn't so big that there would be exact solutions to the comments. You can view the old PR here: GrapheneOS-Archive/platform_frameworks_base-old#559 tl;dr security wise we should not touch devicepolicymanagerservice directly as this service has way too much access, meaning bugs can be catastrophic |
|
@AtlasPilotPuppy as for how it works
also there's an exception in installstart so genuine play store can always install packages in work profiles with unknown sources disabled |
|
Feel free to make a new pr. I can give you access to a work profile account if you need one for testing Edit: you can msg me at https://t.me/mkg20001 |
6 participants
Currently when creating a work profile with a DPC app that requires play services, the DPC app expects play services to also exist on the work profile
Since play services aren't global on GOS, this patch automatically installs them into the work profile
Whether an app requires play services is automatically detected
Because this needs to happen before the DPC app is triggered in any way in the work profile, this needs to be part of the profile creation itself.