27

Background

"Google Play services for Instant Apps" has installed itself onto my device without my permission. It broke functionality of my firewall (AFWall and couple of other apps). And it is updating itself and other apps/components without permission. When I uninstall this component, it downloads itself again and installs right back. (That is, most likely it is "Google Play services" that's actually doing this in the background)

There are no confirmations and no notifications of anything downloading, updating, or installing. The way I discovered it was by noticing that some functionality of my apps was changed/broken. So I used an app ("System Info for Android") and it shows that in fact this "Google Play services for Instant Apps" was installed a day ago.

My question is: how do I completely disable unauthorized updates of an Android device, yet preserving the following functionality:

  • Contacts Sync
  • Google Play Store
  • Google Maps App

In these screenshots, you can see that all settings responsible for automatic updates are switched off. Therefore this download and installation is clearly unauthorized and should not be happening. The screenshot of Instant Apps setting shows up after the thing is already installed. Leaving just the global setting from Google Play Store.

enter image description here
Settings › Apps // Settings › Google › Instant Apps (turned OFF!) // Play Store Settings (Auto Update turned OFF!)

It has all started after I followed a misleading suggestion, you can see in this screenshot, to update "Google Play services":

enter image description here
click image for larger variant


Update 1:

What I've discovered so far is that something (most likely "Google Play Services") is requesting the download + install. The way it's doing it is placing the request with Google Download Manager. Unclear what triggers it, but if watching device closely an icon from Download Manager does show up in notification indicating download percentage. However, upon completion, it instantly disappears. Still, there is nothing indicating installation.

What I've tried so far:

  1. Install the following as user-level instead of system-level apps that they are originally: Google Account, GP Store, and Service Framework (com.google.android.gms; com.android.vending; com.google.android.gsf) This didn't work. The download is still requested and subsequently, installed.
  2. Seems any way of blocking installation will make it download again and again (until your data is used up). So most likely best approach would be to prevent the downloading in the first place. I wasn't able to install Download Manager as a user app, which seems the part that needs to be controlled.
  3. Blocking Download Manager and/or Play Store via firewall is possible, but that breaks down the only trustworthy way of downloading apps.

Update 2:

Downgrading to the previous version of GP Services (v11.3.02) worked for a few days, but today GP services for Instant Apps was downloaded and installed. So, doesn't matter which version you use. Most likely Google will update all phones this way regardless.

Update 3:

So now Google is updating itself on regular basis pretty much whenever it feels like it. If I'm streaming a movie, crippling my speed, using up my internet bandwidth for which I pay money per MB. In this image you can see 3 Google apps were updated without permission.

enter image description here

  • 1
    Hi @Firelord Just to be clear, I'm talking about a "Google Play services for Instant Apps", not the standard "Google Play services". The latter is a recent development and is behaving like a malware (although it is official Google app). I wouldn't go too much in detail on the app functions it broke mainly because it will likely be dependent on a device/ROM (I'm running standard ROM and it is rooted, but for the sake of the question I'd like to find a "normal" non-rooted solution). AFWall it broke in such a way that it gives me "Failed to apply rules" error, intermittently. – Emil Aug 7 '17 at 10:51
  • 1
    @Izzy thanks for the edits, makes it clearer. – Emil Aug 8 '17 at 12:14
  • 1
    Glad to read, Emil! And yes, test it a little more. When there are no side-effects, consider answering your own question :) – Izzy Aug 8 '17 at 22:40
  • 1
    Here is the link to related discussion on Google Play forum. – Stan Oct 4 '17 at 11:24
  • 3
    Hi @frans, the thing is it's not just the bandwidth/costs. It's also installation of unwanted software that I'm trying to prevent. Also, I download apps and updates over the phone's internet as I presently don't have access to WiFi. And another thing is, this updater "listens" for state changes so if you switch to WiFi it prioritizes Google things and cues them first immediately. In the work-around I posted below it's basically a race condition I would download some app before it realizes that it's possible to download updates, but then I lock it again, but that's not 100% reliable way. – Emil Nov 12 '17 at 16:37
7
+25

Update: In recent android versions you can do it from Settings -> Google -> Instant Apps -> OFF.

Original answer follows below:

In the best case scenario this should be enough to block Instant Apps from auto-updating.

Run on device via a terminal (connectbot, juicessh, etc).

pm hide com.google.android.instantapps.supervisor

Or, if running via adb on a pc while connected via cable (or wifi adb), then use:

adb shell pm hide com.google.android.instantapps.supervisor

Unlike pm disable pm hide also works on non-rooted devices. So far, I didn't see any more Instant Apps notifications appearing.

If the above does not work for you then another approach would be modifying the SELinux context of the file/folder (e.g. with chcon).


To revert the pm hide command above use:

pm unhide com.google.android.instantapps.supervisor
  • Well, that would target that particular app, but I'd like to block all unauthorized updates or installation of new apps. Also, this sort of "system-level" installation and download happens hidden from user. The way it works is, it checks version and if it needs to be upgraded it downloads a file behind the scenes. Once the download is complete it attempts to do install and if installation fails it will try again at another time. The temp files are periodically deleted, so if it can't find it... it'll download it again. If you monitor temp folder you can catch it doing this over and over... – Emil Nov 12 '17 at 16:54
  • @Emil: isn't com.google.android.instantapps.supervisor the app that is doing the monitoring you mention? Or is it some specific service from google play services? If it is the second then I guess the recipe is not complete. I've also denied the package permission to run in the background and start at boot. – ccpizza Nov 12 '17 at 17:15
  • I couldn't pinpoint exactly what does the monitoring. On Android there's a system of setting up listeners and there are couple of apps that claim to adjust those but they proved to be ineffective. I couldn't find a way to access/control this "queue" directly or to intercept it somehow. Basically everything Google considers as core, can go around the settings for ordinary apps – Emil Nov 12 '17 at 17:54
3

As the name suggests, it's part of the Google services apps. PlayStore uses it to run apps without installing them (new service). It is possible to disable but not remove (as far as I know it will just keep installing it self as being part of the core services).

To disable, go to Settings › Google › Instant Apps and switch the toggle switch (Reference).

I believe this will be a system app on newer devices as they come out, for the rest of us with older devices they will just force install on compatible devices.

Edit: Due to the fact the question was amended after I answered. This answer applies to none rooted devices. With a rooted device it could be possible but I can't think of a solution that's easy or permanent.

  • Let us continue this discussion in chat. – Josue Rivera Aug 7 '17 at 16:11
  • @Emil I've just cleaned up all comments except the link to your chat (where the comments are still available). Further, I cannot agree with you that this is not an answer: in your question you wrote "there seems to be no easy way to permanently disable" and "My question is: how do I disable this functionality entirely" – which is what Josue presents in this post: "To disable go to Settings, Google, Instant Apps and switch the toggle switch." If you have done so and it didn't work, please state that. – Izzy Aug 7 '17 at 23:03
  • @izzy thanks, my concern was/is pretty much that the Answer is a duplicate of the (portion) of Question. I just don't see the point of sending readers to a different page: "To disable, go to Settings › Google › Instant Apps and switch the toggle switch (Reference)" When it's right there in the question with a screen shot even. It deters from the question because people think that it is already answered. – Emil Aug 8 '17 at 4:24
  • 1
    Anyway I'm done trying to explain this. He asked a question, I basically said no, explained why and gave information for anyone else that might find themselves in similar situations. Question was changed, I edited to express that my answer applied to original question. If I misunderstand how rules work here delete my answer and let me know how I can do better. – Josue Rivera Aug 8 '17 at 13:24
  • 1
    @JosueRivera leave that be if you are satisfied you are not at wrong. If the answer is wrong folks can downvote it and move on. – Firelord Aug 8 '17 at 13:50
1

About: [Root Only] This solution involves blocking write access to the temp (cache) folder where Google downloads its system apps such as Google Play Services, Google Play services for Instant Apps, etc. It's simpler than it looks, because I'm explaining everything, it looks like a lot. Afterwards, installing new apps essentially becomes 3 steps and the process is similar to installing programs on a PC.


Background: Under my system the folders work as follows:

1) /data/data/com.android.providers.downloads/cache
* This is the folder where Google system updates (as well as New system apps) are installed.
* Unfortunately, this folder is also used for downloading normal new apps. So you can't just block it permanently. You have to be able to block/unblock it when downloading new apps.

2) /mnt/sdcard/Android/data/com.android.vending/files
* This folder is used to update normal (non Google-system apps). So no need to block this, or do anything special when it comes to updating your normal apps like Facebook, games etc.


Solution: The cache folder above is kept locked during normal operation. When you want to install a new app, overall process is as follows (although mostly automated): (1) unlock cache folder (2) lock app folders, in case it sneaks through while it's unblocked and installs it. (3) Download your new app from the store (4) Copy downloaded program from installation folder to another place, and rename it from default name (download.apk) (5) Clear and lock cache folder (6) unlock the apps folders (7) Click on the apk file to install it.

Obviously you don't want to type this at the terminal every time so these are automated steps. They involve using two additional apps as well as having BusyBox installed (to be able to use chattr command by the scripts)

  1. Locking unlocking is achieved by an app called Gscript. You can use any other app that achieves execution of scripts. There's a version in google store, but it crashes for me and other people. There's a stable fork available here: https://bitbucket.org/Equidamoid/gscript (Thanks to author's post here: https://stackoverflow.com/a/20328927/7609435) Just paste these two scripts there. (Both need SU)

    A) Execute before download - Lock apps / Unlock cache

    chattr +i /data/data/* chattr +i /data/data chattr +i /data/app/* chattr +i /data/app chattr -i /data/data/com.android.providers.downloads/cache

    B) Execute after download is complete and after you copied the file - clear and lock cache / unlock apps

    rm /data/data/com.android.providers.downloads/cache/* chattr +i /data/data/com.android.providers.downloads/cache chattr -i /data/data/* chattr -i /data/data chattr -i /data/app/* chattr -i /data/app

  2. You will know the app is downloaded when the Play Store says "download failed". It'll say that because it couldn't install the apk, but it was actually successful downloading and it is sitting inside the cache folder. Before running script (B) above, you have to move the file from cache folder elsewhere. You can do it using any app of course, but I like to use Total Commander, because it can have two panes and it supports bookmarks (I added cache to it). So move it and rename the file from default name to something else and then run the (B) script above. Also note, when copying the APK it should have an icon of the app. If it has the default icon it's probably corrupt download due to other unrelated reasons, so you can try downloading again.

  3. Now the cache folder is cleared and locked and apps folders are unlocked. (you can double check that cache folder is empty just to be 100% sure but I doubt this is necessary) You can now install the APK you downloaded.

Note1: If you click on a new download and it says "pending" just (force) close Google Play and restart it, it should start downloading automatically.

Note2: I have tested this with only Android: 6.0.1 / MIUI: 8.5.3.0 so this solution might not be universal. Check to see if you have the cache folder and if the download of the Google Play Services is being uploaded there (once upload is finished it stays there for a while).

WARNING: It's fine to keep cache folder locked up, but if you happen to restart your phone while those data folders are locked, your phone will not boot. And you'll need to go manually and change it from TWRP shell.

P.S. I understand this solution is not for everyone, but if your primary concern is stability and to keep data-usage under control, this works... for now. Hopefully someone will come up with a better answer than this.

  • Disclaimer: Now that your phone is no longer automatically updated, if there is a vulnerability with previous Google system you could be exposed. However, personally, I consider a vulnerability when something can be installed without explicit permission. – Emil Oct 1 '17 at 20:28

protected by Community Oct 4 '17 at 14:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.