IPC Sandboxing

[jdspugh]

To reproduce the situation (using Pixel 4, Android 13): I install Google Lens with networking off. The app asks for the Google app otherwise I can't continue. I install the Google app with networking disabled. Now I can run Google Lens, but network connectivity is disabled. I enable networking on the Google app. Now Google Lens can access the internet despite having the networking off still.

I assume Google Lens talks to the Google app through IPC and can access the internet through it. This means any app can access the internet via any other app that has internet connectivity if the apps agree on a common IPC protocol for doing this. I was going to use GBoard with networking off but now I see apps are not sandboxed between each other. IPC is still available. My keyboard strokes could well be being logged via the Google app to some servers.

Conclusion: Android's IPC needs to be sandboxed in GrapheneOS.

[Niko4u5]

#2197 might be what you are looking for