Ability for integrators to disable SafetyNet checks

[SkewedZeppelin]

Is your feature request related to a problem? Please describe.
I'd like to add optional opt-in unprivileged microG support to DivestOS, however SafetyNet both won't ever succeed on it nor do I want my users needlessly running the proprietary DroidGuard executables.

Describe the solution you'd like
An option in the microg.xml settings override to force disable and hide any function that directly downloads/executes more proprietary code.

[mar-v-in]

After further investigation, I figured:

• Even without running DroidGuard, we can support SafetyNet for ReCAPTCHA (probably asking the users every time to fill in captchas) and ReCAPTCHA Enterprise (users may receive a lower score and thus may not be able to use some apps)
• We also support using a remote DroidGuard service, this works even on devices and systems where it wouldn't work otherwise.

So instead of disabling all UI for SafetyNet via microg.xml, I think it makes more sense to just disable local DroidGuard execution.

That said, given the large amount of devices supported by DivestOS, how do you know that SafeyNet/DroidGuard won't pass on any of them? Privileged access is not strictly required (at least not on all devices) to pass SafetyNet.

[SkewedZeppelin]

I think it makes more sense to just disable local DroidGuard execution.

That is a good approach.

how do you know that SafeyNet/DroidGuard won't pass on any of them

I completely remove the default/stock OS fingerprints that LineageOS uses, it was a prereq for actually supporting delta/incremental OTA updates.
And I'm not going to ship ih8sn or the snet downgrade patchsets like other systems.

[mar-v-in]

I completely remove the default/stock OS fingerprints that LineageOS uses, it was a prereq for actually supporting delta/incremental OTA updates.

The device profile feature in microG can be used to spoof fingerprints to DroidGuard to pass SafetyNet when needed.

[SkewedZeppelin]

I did actually try the self test on both clark/17.1 (can't be relocked) and taimen/20.0 (relocked bootloader and verified boot enforcing) and both said "CTS profile match failed" iirc.

[mar-v-in]

I don't say it's going to work for all devices easily. Pixel devices are harder and unlocked bootloader generally doesn't work without kernel patch that hides the bootloader state (which is trivial though).

Anyway. With 4772008 there is now an boolean option in microg.xml called droidguard_force_local_disabled which you can set to true.

[SkewedZeppelin]

Thank you for these additions!