4

For a while, I had an exclamation mark instead of a signal status in the top bar, and some apps didn't realize they were connected to Internet when other worked perfectly. Thanks to AFWall+ logs, I found the issue. I need to allow access to an app called com.android.engineeringmode.

But this app is tied (in OnePlus 3) with some others, as you can see in this screenshot : screenshot taken in AFWall+

I'm OK to allow access to EngineerMode, but certainly not to all this bunch of apps (especially camera or fingerprints services).

After searching the web, I found that all theses apps are linked in /data/system/packages.xml using the sharedUid 1000. But it is said to never change the UID of an app when it's shared (I didn't really get why).

I'm using the stock ROM (OxygenOS 3.2.8) from OP3, but rooted (got Xposed an Xprivacy too), so it's Android 6.0.1.

Is there any chance I can allow Network access to EngineerMode only ?

  • Even if you change the sharedUID in that XML file, the modification gets lost after a reboot. Back to square one. – Firelord Aug 22 '17 at 15:33
2

The solution that Dan Hulme has provided is right and I'd like to make it clearer: You have to re-compile the ROM but wait! Open the source for EngineerMode and look for something in AndroidManifest.xml like sharedUserId="android.uid.system" and change it to something else.

That's the fundament of a shared user ID. You must modify the app so that it doesn't require a shared UID anymore.

  • You may be right, I didn't really think of this because I didn't want to bother recompiling everything (and re-install all my apps...). The chosen solution really fixed my issue in a best way. Maybe the problem here is I've asked for the wrong thing, trying to go one step forward and wanting to split apps tied when what I really wanted was to have Internet access detection behave correctly (I hope my poor English can be understood). Anyway, thanks for your interesting answer. – Stopi Aug 22 '17 at 13:40
2

I don't think it's possible to change this without recompiling the ROM. You can't change the UID of apps after they're installed because they won't be able to access their files any more, and because it will confuse the app permissions system.

Maybe there's some other way around the problem with Xposed, but I don't know about that. It might be possible for an Xposed module to detect the exact call the package is making (to distinguish it from the calls made by other packages in the same process), and mark it for AFWall to allow it. That way you wouldn't need to split up the apps at all.

An alternative might be to find where it's trying to send traffic to, and whitelist that address for that process. Again, this would solve the specific symptom without splitting the apps. If it's the captive portal detection, it's probably http://client.android.com/generate_204.

  • Thank you for this answer, I've been thinking of using a custom script which is something quite easy to do with AFWall+, but I couldn't think of a way to mark properly the request. I'm going to test if I can whitelist the captive portal detection and see if it solves my issue. – Stopi Aug 22 '17 at 11:46
  • Using adb shell I just removed the check with the command "settings put global captive_portal_detection_enabled 0", then reboot. It appears that fixed my issue, thanks for pointing out the captive portal detection thing. – Stopi Aug 22 '17 at 11:57
  • And by the way, thank you too for the brief explanation regarding why I shouldn't try to slip the package sharing one UID – Stopi Aug 22 '17 at 12:00
  • Sorry but this answer seems confusing and... wrong. – iBug Aug 22 '17 at 13:09
  • 1
    @Stopi I'm glad it set you on the right track. It would be great if you write up the steps you took, post it as an answer, and then accept your answer in place of mine. – Dan Hulme Aug 22 '17 at 13:24
1

While iBug's comment seems a better answer to the question, my real need was to have a correct Internet access detection over the system.

In order to fix my issue I had to open an adb shell, type in

settings put global captive_portal_detection_enabled 0

Then reboot. The exclamation mark went away and problematic apps behave better now.

For the record, this prevent a check on Google's servers. This check was impossible with my firewall's rules.

Thanks to Dan Hulme and iBug for their help.

  • 2
    In case it's not obvious to other visitors, note that this disables the detection completely, so you won't get the "Sign in to Wi-Fi network" notification when you connect to a captive portal. – Dan Hulme Aug 22 '17 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.