Gmscore: Permissions not requested

[ploink]

First, thank you very much for latest release! (v0.2.11.202414)
Even though I collected all the checkmarks in self-check, gmscore is still missing permissions ACCESS_FINE_LOCATION and READ_EXTERNAL_STORAGE. It does not request them.

One can check for ungranted permissions with:
$ dumpsys package com.google.android.gms | grep granted=false

For now I have granted the permissions manually:
$ pm grant com.google.android.gms android.permission.ACCESS_FINE_LOCATION
$ pm grant com.google.android.gms android.permission.READ_EXTERNAL_STORAGE

[patrickdrd]

I think I've got a similar problem,
location permission isn't granted and:

problems with google maps, after opening the app,
my location isn't detected

(I'm running google maps version 10.19.2 because of the message about google play services that needed to be updated..)

please @mar-v-in check and fix

[D3SOX]

For me background location is not working and granting doesn't work either. Using NanoDroid-22.9.20200910

microG permissions screen


Terminal output


[ploink]

@D3SOX I noticed you have permission flag APPLY_RESTRICTION set to the background location permission. My phone does not have that:
android.permission.ACCESS_BACKGROUND_LOCATION: granted=true, flags=[ SYSTEM_FIXED|GRANTED_BY_DEFAULT|USER_SENSITIVE_WHEN_GRANTED|USER_SENSITIVE_WHEN_DENIED|RESTRICTION_INSTALLER_EXEMPT|RESTRICTION_SYSTEM_EXEMPT|RESTRICTION_UPGRADE_EXEMPT]
Maybe your rom has some additional security features or you have some security app installed that causes this. Open app info for gmscore and see if you can change background location permissions there.
You can also try deleting data for gmscore, that will wipe all permissions for the app so you can try assign them again.

[mar-v-in]

ACCESS_BACKGROUND_LOCATION is a hard restricted permission, which means that the decision if you can enable it is done by the app installing it (or if the app is part of the system image, the system decides this). Thus, this maybe is an issue of NanoDroid? @Nanolx

[drrossum]

• on Friday, 2020-10-16 09:41 +0000, Marvin W [e-mail] wrote:

ACCESS_BACKGROUND_LOCATION is a hard restricted permission, which means that the decision if you can enable it is done by the app installing it (or if the app is part of the system image, the system decides this). Thus, this maybe is an issue of NanoDroid? @Nanolx

Going through the list of requested permissions I see that there are two permissions not currently granted on my system:

ACCESS_BACKGROUND_LOCATION
ACCESS_COARSE_UPDATES

I guess these are both hard restricted permissions?

[D3SOX]

@ploink

I already tried changing the permission from there but it has no option for it


When I tap on location settings it just takes me there


The ROM is Paranoid Android, self compiled with signature spoofing patch
(patch worked but I had to adjust the paths) and without Gapps

Deleting data didn't change anything

Nevertheless, I don't think this is as big of an issue since I haven't noticed anything that doesn't work. Other Apps with background location granted work as expected.
Only the checkbox is not checked.

[Nanolx]

@mar-v-in likely. I've observed that installing NanoDroid directly into /system seems to always work, but depending on the ROM installing as Magisk Module may fail in this regard.

A temporary fix is to install uG as user app

pm install -r /data/adb/modules/NanoDroid/system/priv-app/GmsCore/GmsCore.apk

(or NanoDroid_microG instead of NanoDroid, depending on the module installed).

I'll investigate further, but may take a few days.

[Nanolx]

Yes, it's just like that. Installing NanoDroid into /system before booting the ROM the first time (just as one does with GApps; install ROM > install NanoDroid to /system > boot into ROM) solves that issue. It also properly auto-grants all permissions to GmsCore (except android.permission.FAKE_PACKAGE_SIGNATURE), which is desireable, though.

Most A/B or S-A-R devices require /data to be clean when starting the first time (observed this on OnePlus 5T and OnePlus 6), thus installing NanoDroid as Magisk Module is always "dirty flashed" (flash ROM > boot into ROM > boot into TWRP > Flash Magisk > Flash NanoDroid); "clean flash" (install ROM > install Magisk > install NanoDroid > boot into ROM) like mentioned above results in a boot loop on those devices, thus is not possible.

For one reason or another Android does deny android.permission.ACCESS_BACKGROUND_LOCATION on "dirty flashes", even though it is properly privapp-whitelisted. Also all other should-be auto-granted permission need to be manually granted, as opposed to /system mode installation.

On older devices where you can flash ROM and Magisk in one go and sucessfully boot up, this does not happen. As mentioned before pm install -r /data/adb/modules/NanoDroid/system/priv-app/GmsCore/GmsCore.apk fixes the issue for Magisk Installations aswell.

I observed this on both Android 10 (AICP 15) and Android 11 (Syberia 4.1). Tomorrow I'll update the Magisk Modules's service.sh in order to silently auto-"userify" GmsCore, to workaround the issue.

Since no Magisk GApps package exists (until now I never thought about why that's the case) and given that privapps should be available right from the very first start, I suspect that behaviour is actually on purpose, so that proposed change to service.sh is likely the ultimate best I could come up with for installing NanoDroid as Magisk Module.

Unless someone can point me into a different direction.

[ploink]

@Nanolx

Unless someone can point me into a different direction.

One thing left to try is requesting the permission on behalf of the gmscore userId, similar to #1102

On my phone the permission is granted, but when I try to revoke the permission as root, I get:

# pm revoke com.google.android.gms android.permission.ACCESS_BACKGROUND_LOCATION                                      
Security exception: Non-System UID cannot revoke system fixed permission android.permission.ACCESS_BACKGROUND_LOCATION for package com.google.android.gms

But using the app's system user id works:

#dumpsys package com.google.android.gms | grep userId=                                          
    userId=10174
    userId=10174
#pm revoke --user 10174 com.google.android.gms android.permission.ACCESS_BACKGROUND_LOCATION

So if you grant it with the "--user" option it might work too?

The permission on my phone:

      android.permission.ACCESS_BACKGROUND_LOCATION: restricted=true
        android.permission.ACCESS_BACKGROUND_LOCATION: granted=true, flags=[ 
SYSTEM_FIXED
|GRANTED_BY_DEFAULT
|USER_SENSITIVE_WHEN_GRANTED
|USER_SENSITIVE_WHEN_DENIED
|RESTRICTION_INSTALLER_EXEMPT
|RESTRICTION_SYSTEM_EXEMPT
|RESTRICTION_UPGRADE_EXEMPT]

I suppose different roms have different permission flags, the "RESTRICTION_SYSTEM_EXEMPT" makes it work with the "--user" option and "RESTRICTION_UPGRADE_EXEMPT" allows granting the permission on upgrading the apk.

@D3SOX None of the exempt flags are set in your case, so I doubt any of these two methods work for you? Considering you rom is _Paranoid_ Android, this may be by design.

[Nanolx]

@ploink I've modified the nanodroid-perm script to do so.

For reference: https://gitlab.com/Nanolx/NanoDroid/-/commit/0437a12adf71a28b370fe0d3a92b92609ef1c038

Time to roll-out NanoDroid 22.90 (23.0-beta1), because now after all this rework and fixing is almost finished, it's time to give brave users the opportunity to test. :]

[GitGangGuy]

Hi, I can't grant some permissions either (They also have APPLY_RESTRICTION activated):

android.permission.RECEIVE_SMS: granted=false, flags=[ USER_SENSITIVE_WHEN_GRANTED|USER_SENSITIVE_WHEN_DENIED|APPLY_RESTRICTION]
android.permission.ACCESS_BACKGROUND_LOCATION: granted=false, flags=[ USER_SENSITIVE_WHEN_GRANTED|USER_SENSITIVE_WHEN_DENIED|APPLY_RESTRICTION]

I'm running ProtonAOSP (with Android 11) on a Pixel 5 using Magisk and the microG installer revived module.
I see that some workarounds for Nanodroid have been included, but what about other installation methods? How can I grant those permissions? Will I have to do a factory reset/wipe data?

[Nanolx]

The fix is to install microG not just as a priv-app, but also as a user-app, i. e. an update.

a) go to /data/adb/modules/microG_blabla/system/priv-app/GmsCore/GmsCore.apk and tap on the APK to install it as update
b) remove any runtime-permissions.xml from /data/users/*/
c) reboot
d) grant all permissions again

profit.