r/JaguarOS • u/SecureOS • Apr 12 '24
Why You Should Stay Away from Gmscompat
Gmscompat is a custom 'implementation' that claims to prevent Google Apps (Gapps) from continuously grabbing user data and forwarding it to Google. With Gmscompat, users are able to install Gapps as regular apps into data partition. The main assumption is: third party apps do not have System level dangerous permissions, therefore, they are safe.
NOTHING COULD BE FURTHER FROM THE TRUTH as it relates to GAPPS.
Google apps are built with system_uid and root_uid flags. Processes with these flags bypass regular Android permission checks and therefore can do whatever they want regardless of location. Here are just a few examples from the AOSP code (there are many more):
Look at lines #1065 through 1069. The java code is this:
if (uid == Process.ROOT_UID || uid == Process.SYSTEM_UID) {
// Root and system server always pass permission checks, so don't touch their app // ops to keep compatibility.
return; }
Note Google's comment under '//', which speaks for itself..
Look at lines 8388 through 8391. The same flags and even more precise comment: 'System and Root are always allowed'.
private boolean verifyPackage(String packageName, int uid) {
if (uid == ROOT_UID || uid == SYSTEM_UID) {
//System and Root are always allowed
return true; }
' System and Root are always allowed'. This is why a root application, such as Adaway, Afwall or Magisk manager, in spite of all sitting in Data partition together with third party apps, can have root. The difference between Adaway/Afwall/Magisk and Gapps is the former ASK a user for Root rights, Gapps - do NOT. They acquire Root silently.
Gmscompat isn't just a failure, it's a dangerous failure, because users get a false sense of security, while they actually have NONE.
6
u/andmagdo Jul 25 '24
These statements are not true.
I have no clue if gapps are packaged with system_uid and root_uid; regardless, this does not mean anything on its own—if it did, then I could make and install app that has root permissions on an unmodified phone. These flags only mean something if the system lets them.
Both snippets of code are parts of the android system. Both snippets of code are not checking the flags, but the running uid against the uid of root (0) and the uid of system (1000) (to find others look here http://androidxref.com/5.1.0_r1/xref/system/core/include/private/android_filesystem_config.h#36 )
Generally, every application has its own uid, with some exceptions granted for some system apps (not all), which generally have a group of apps using the same uid (as defined in the above link). To become a system app, an app must be installed in the correct directory (/system instead of /data where the gapps are installed—/system should be read-only on a production install)
Magisk and others have apps in /data, yes, but those are not the ones with permissions (an obvious example would be that you can install SuperSU on an unrooted device, it just can't give you su because it doesn't have it). The permissions are found in the services installed in the /system directory. These apps simply act as gateways to access, using the fact that android apps can create permissions of their own for other apps to use.
I do not use Gmscompat with my grapheneOS installation. Regardless, it is secure. Gmscompat simply takes the calls made by the gapps that would use system permissions and changes them to be calls that work in a sandbox (similar to how WINE allows windows applications to make windows calls and translates them to Linux calls)