Location stops working with Sandboxed Play Services installed

[brokoler]

My situation and what I've done:

• Running the stable build RQ3A.210805.001.A1.2021081822 on my Pixel 4a
• Successfully installed Sandboxed Play Services like mentioned in this guide: https://grapheneos.org/usage#sandboxed-play-services
• Enabled location permission for Google Play Services
• Checked that location is enabled correctly for each app which is requesting the permissions
• Tried multiple apps which need location services to navigate (Magic Earth, Osmand, Google Maps)

Issue:
My location only seems to be recognized correctly after a device reboot by several apps.
When the device is up for around 3-4 minutes, the location stops to be working until the next reboot of my device.

Different behavior by different apps:

• Magic Earth: After reboot working immediately, after closing the app and waiting 3-4 minutes location is still shown but stuck
• Osmand: After reboot working immediately, after closing the app and waiting 3-4 minutes no location is found until reboot
• Google Maps: After reboot working immediately, after closing the app and waiting 3-4 minutes no location is found until reboot

When location permission for Google Play Services is removed, none of these apps find my location. Not even after a reboot.

This issue seems only to occur when Sandboxed Play Services are installed.

[brokoler]

Just installed GrapheneOS from fresh without Sandboxed Play Services, all apps seem to work without any issues now, no restart needed.

Google Maps recommended to install Play Services on the first start, but it seems to work well apart from that. I will try with a fresh installaton of Play Services to see when the issue is happening.

Edit: Issue is indeed happening again with a fresh install from factory reset, only when Google Play Services are installed.

[thestinger]

We're aware that more shims are required for the Play services geolocation APIs to be fully working. An improvement has been made for the next release but more are needed.

[brokoler]

Most apps seem to switch to location services provided by Play Services, as soon they are installed.

I'm sadly no developer, but would it be possible to add an option which whitelists the use of Sandboxed Play Services for specific apps only?

This would allow to use the location services by GrapheneOS with all apps which are not explicitely whitelisted for Play Services and lead to more privacy in general.

[thestinger]

I'm sadly no developer, but would it be possible to add an option which whitelists the use of Sandboxed Play Services for specific apps only?

No, because there's nothing special about how this works with Play services and as a rule we aren't providing special integration in the OS. It has no special access or privileges on GrapheneOS. It's simply a regular sandboxed app with the same rules as any other apps.

The OS offers a standard way to choose which apps can communicate with mutual consent: profiles. You can make a dedicated user / work profile for apps with a hard dependency on Play services and only install it there.

lead to more privacy in general.

Having Play services installed doesn't give apps the ability to use Google services they couldn't use without it. Many of the Google libraries do offer some or most of their functionality without needing Play services, including the Ads SDK which fully works without it other than a few minor things. Play services is simply a regular sandboxed app and we won't be providing any special integration or toggles for it. It wouldn't make any sense and those toggles would be theater that didn't actually work meaningfully. As a rule, we don't make those kinds of features.

[thestinger]

#156 is a planned feature as an alternative to profiles but it would have a lot of caveats. Profiles are isolated workspaces with their own instances of apps, app data and shared data without shared data or communication across profiles.

If you disallowed app A and app B from communicating but gave them access to the same shared data like contacts, they could just communicate through contacts. Similarly, if you allowed app A to talk to app C, and allowed app A to talk to app B, then app A and app B could potentially communicate via app C if it intentionally or unintentionally provided a way to do that.

[brokoler]

Thank for your reply, I understand your points from a developers point of view, absolutelty the right decisions.

I further tested how I could accomplish an ideal setup which isolates specific apps from Play Services. Multiple users were no choice, since the environments are isolated completely and apps cannot be shared during runtime. I did set up a work profile with Shelter and installed the Sandboxed Play Services only to the work profile.

And what should I say, it works. Google Maps is finding my location every time without requesting Play Services location permission.

The only issue I see: Google Maps and Youtube for example recognize, that Play Services are installed on the system. When these apps are started from my private profile without Play Services, they open a popup notification each time which tells "Play Services are updated right now". I can click somewhere on the screen and it disappears, which allows me to use Google Maps.

That's my solution for now until the geolocation API is updated in a future release of Graphene. Thanks so much for your work.

[thestinger]

This is fixed.

[thestinger]

Next release will be in Beta much later today and then probably in Stable within a day or two.

[pshirshov]

Actually I'm experiencing exactly the same issues on last release.
All the apps can't get location once I install sandboxed play services using the official guide.
Is it expected?

UPD: actually GPSTest from F-Droid shows location, at least when the phone is outdoors.
Though apps like OsmAnd, Google Maps and other apps which need location (e.g. Tinder) fail to obtain it.

They all do work when GPlay services are not installed though.

@pshirshov

All the apps can't get location once I install sandboxed play services using the official guide.
They all do work when GPlay services are not installed though.

As stated further above, more work is necessary and still on-going to make Play Services location APIs work properly and consistently.

If Play Services is not installed, the apps will use the OS location APIs to gather location data. If Play Services is installed, it will use Play Services location APIs.

[thestinger]

All the apps can't get location once I install sandboxed play services using the official guide.

Many apps will switch to using Play services location APIs when they're available instead of using the OS APIs. It's entirely expected that this will happen within the profile where you choose to install Play services. You aren't granting Location + Phone access to Play services so it's unable to provide the location information apps are expecting to get from it.

[thestinger]

It works the same way it does on the stock OS in this regard. When Play services is available, apps will use it that would otherwise fall back to using the OS APIs. They want the enhanced features offered by Play services when it's there but often have support for using a different approach. Regardless of whether you grant location access to Play services, by granting it to an app like Tinder you've granted it to the client-side library portion of Play services anyway.

You can use foreground Location access rather than needing background since we have it using foreground services as part of the compatibility layer so it won't be able to use it when the profile as a whole isn't in the foreground or if the foreground services aren't active like any other app.

[cedws]

Having a similar problem with GPS/Location in certain apps with the sandboxed Play Services installed.

@thestinger I have granted Location access at all times to "Google Play services" as you described above but no luck (restarted the device too to be sure). I was expecting to see "Google Services Framework" under Location too but it isn't there.

I found this in ADB logs, seems pertinent:

09-11 13:25:13.865  1477  2577 W ActivityManager: Appop Denial: Accessing service com.google.android.gms/com.google.android.location.internal.server.GoogleLocationService from pid=3128, uid=10166 requires appop COARSE_LOCATION