Afwall: sheltered app cant be found

[0lm]

hi there

i noticed a strange bug. i activated dual app and multiuser support in the experimental settings in afwall+.
so far, everything worked fine. im using the shelter app by PeterCxy. that app creates an isolated profile.
you can clone existing apps into that shelter, or you can directly install apps into that shelter.

so what error i occured is, that if i have an app only in the shelter, afwall+ doesnt list it. so i cant give wifi permission for that app. so in other words, unless i dont have an app installed on both, the main phne profile and the isolated shelter profile, i cant see the cloned one in the list.

but as you can already guess, it makes no sense to have all apps double installed. some apps shall be only in the isolated profile, and others only in the main profile.

is there a way to make afwall+ find apps which are only installed in the shelter?

[subiol]

I have the same issue. I can not enable AFWall+ because it blocks from accessing the internet applications that are sheltered in the work profile.

[maxmopp]

You can to use the "Custom Script" option in AFWall+; it entails a bit of researching on your fone:

• find out the user shelter sets up for you (default=0) - cat /data/system/users/userlist.xml eg user id="11"
• do a logcat | grep u11:
  ActivityManager: START u11 {cmp=com.whatsapp/.CountryPicker (has extras)} from uid 1110271
• or List of apps: /data/system/packages.list (short for /data/system/packages.xml)
• create CustomScript.sh
  https://github.com/ukanth/afwall/wiki/CustomScripts
  `# Necessary at the beginning of each script!
  OEM_SCRIPT_PATH=/storage/emulated/0/scripts/CustomScript.sh
  IP6TABLES=/system/bin/ip6tables
  IPTABLES=/system/bin/iptables

WHATSAPP=1110271
$IPTABLES -A afwall-3g-home -m owner --uid-owner $WHATSAPP -j RETURN
$IPTABLES -A afwall-wifi-wan -m owner --uid-owner $WHATSAPP -j RETURN
`

• reload AFWall+

[tristan-k]

I'm struggeling with this issue as well.

[geronimoge]

I have the same problem

[jetta20162]

As a workaround, install app in both profiles, set permissions only for isolated profile on afwall and apply settings. Disable the app from main profile.

[johnnyeightpence]

I have the same issue but only since the last update 3.04.
It worked before, but when I install the earlier versions it remains not working.
Before the update all apps from shelter were marked with "(M)".
Now there is just one app although all apps are installed in both profiles.
Any ideas to solve this?
Thanks !!!

[Perflyst]

I wonder why nobody found this yet but there is an option under "experimental" in settings to enable work profiles. All apps are shown doubled even if not "cloned" into work profile but doesnt matter

[abesty]

Experimental feature (work profile) still doesn't recognized apps if i just installed apk rather than clone apps :disappointed_relieved:

[DerWaldie]

I have the same problem.

[mxiia]

just adding another voice to the list of people experiencing this issue.

The option under 'experimental' works, however the app needs to be installed in the main profile for the sheltered option to show up in the list of apps.

Example.

Contacts is installed in both my main and 'work'/sheltered profile.

I see Contacts and Contacts (m), the (m) option is for the sheltered app.

I have PayPal only installed in my sheltered profile, there is no PayPal or PayPal (m) option in AFWall

IF I install PayPal to my main profile, both PayPal and PayPal (m) show up. I can modify the settings for PayPal (m), apply the changes, uninstall the app from the main profile, and the settings persist.

Edit: this seems persistent until I make any other changes to the rules.

[T-vK]

I can confirm when I install WhatsApp in Shelter so that it's installed in the work profile, it doesn't show up in AfWall. Apps that exist in on both sides, the owner profile and the work profile show up on the other hand.
Are there any plans on fixing that? @ukanth

[k3karthic]

You can get a list of app names and their associated "uid" using the following command,

pm list packages -U --user 11

To search for an app by name use,

pm list packages -U --user 11 | grep <name>

I created a custom script to allow certain apps access. "WHITELIST" is a space-separated list of apps which are allowed to connect to mobile data & wifi.

OEM_SCRIPT_PATH=/storage/emulated/0/scripts/CustomScript.sh
IPTABLES=/system/bin/iptables

APPS=$(pm list packages -U --user 11)
WHITELIST="amazon gearhead feedly rocket maps youtube"

for APP in $WHITELIST
do
        UID=$(echo "$APPS" | grep $APP | awk '{ print $2 }' | sed 's/uid://')
        if [ ! -z "$UID" ]; then
                ARR=($UID)
                for U in "${ARR[@]}"
                do
                        $IPTABLES -A afwall-3g-home -m owner --uid-owner $U -j RETURN
                        $IPTABLES -A afwall-wifi-wan -m owner --uid-owner $U -j RETURN
                done
        fi
done

I used adb to copy the script to the phone and place it in "/data/local" folder. As the script loops for each app,

there is a pause in afwall when applying the rules.

Note: Replace user-id "11" with the uid set by the shelter app in your phone.

[T-vK]

That's neat, but I would really prefer for the apps to show up in the app so that I can make changes to my rules using the GUI whenever I want.

I spent the last few days trying to simply create blank dummy apps that I can install outside of Shelter so that the real ones would show up in AFWall. My idea was to simply create blank apps th the exact same id, e.g. com.whatsapp and install that on my main user account while the real com.whatsapp would only be installed within the work profile (Shelter). Unfortunately Android does not seem to like that. At first it complained about not being able to install an older version of an app than already installed under a different user, but after bumping the version far enough it still wouldn't finish the installation because the signatures do not match.

Edit:
I think this issue could be fixed by adjusting the getApps method: https://github.com/ukanth/afwall/blob/beta/aFWall/src/main/java/dev/ukanth/ufirewall/Api.java#L1393

I'm neither a Java nor an app developer, but from a quick look it appears to me that the function only iterates over the apps of the current user and then checks if these apps also happen to be installed in other user profiles. Unfortunately the code is pretty messy (no offense) which would make it very time-consuming to make this work. But in theory, you would iterate over the uid array list and then call pkgmanager.getPackagesForUid(uidEntry) for each entry to assemble a list of all apps from all users.

Ideally the whole getApps method would be rewritten entirely because it it's current state it doesn't look maintainable to me.

Edit2:
Turns out there is a fundamental issue. There simply is no Java API to list the apps of other users. getPackagesForUid isn't actually what it looks like. So we probably have to go the painful route of extracting the data via a root shell. I'll do some more digging and see if I can find a good way to do this.

[youbloub]

You can get a list of app names and their associated "uid" using the following command,

pm list packages -U --user 11

To search for an app by name use,

pm list packages -U --user 11 | grep <name>

I created a custom script to allow certain apps access. "WHITELIST" is a space-separated list of apps which are allowed to connect to mobile data & wifi.

OEM_SCRIPT_PATH=/storage/emulated/0/scripts/CustomScript.sh
IPTABLES=/system/bin/iptables

APPS=$(pm list packages -U --user 11)
WHITELIST="amazon gearhead feedly rocket maps youtube"

for APP in $WHITELIST
do
        UID=$(echo "$APPS" | grep $APP | awk '{ print $2 }' | sed 's/uid://')
        if [ ! -z "$UID" ]; then
                ARR=($UID)
                for U in "${ARR[@]}"
                do
                        $IPTABLES -A afwall-3g-home -m owner --uid-owner $U -j RETURN
                        $IPTABLES -A afwall-wifi-wan -m owner --uid-owner $U -j RETURN
                done
        fi
done

I used adb to copy the script to the phone and place it in "/data/local" folder. As the script loops for each app,

there is a pause in afwall when applying the rules.

Note: Replace user-id "11" with the uid set by the shelter app in your phone.

hello,
any news for sheltered apps ?
for me situation is the same: if I clone app, I get rules, but if I uninstall from user 0, rules disapear for work profile (app installed under shelter)

I don't manage to get this script working (replaced user 11 by my user 10) .

[JonnyTech]

Is anyone working on an official fix for this old and annoying bug? Willing to test any builds produced.

[T-vK]

I think I tried at some point, but I gave up after realizing what a horrendous pile of hacks and workarounds are necessary to achieve this and just anything root related on Android.
I mean did you know that there is no way to access any of the Java APIs as root? Instead you have spawn a shell and write shell scripts calling the right binaries with the right parameters and constantly go through the Android source code because of lack of documentation. And don't get me started on parsing the output of some of those binaries.
It's not fun.

[thereisnotime]

Here is a better script that I made where you do not need to find the user id manually:

# Necessary at the beginning of each script!
OEM_SCRIPT_PATH=/storage/emulated/0/scripts/WhitelistApps.sh
IP6TABLES=/system/bin/ip6tables
IPTABLES=/system/bin/iptables
# Whitelist by adding appname and | for separation 'app1|app2|app3' etc.
MYLIST='revolut|icard'
USERIDS=$(dumpsys activity | grep -E "(mStartedUserArray: \[)(.*)(\])" | egrep -o '[0-9]+')
for USERID in $USERIDS
do
    WHITELIST=$(pm list packages -U --user $USERID | grep -E $MYLIST | cut -f 3 -d ':')
    for APPID in $WHITELIST
    do
        # echo "Allowing traffic for UserID: $USERID, AppID: $APPID"
        $IPTABLES -A afwall-3g-home -m owner --uid-owner $APPID -j RETURN
        $IPTABLES -A afwall-wifi-wan -m owner --uid-owner $APPID -j RETURN
    done
done

In the program settings for custom script just write:
. /storage/emulated/0/scripts/WhitelistApps.sh

And disable/enable the firewall.
I had to do a phone restart because it was not applying at first.