What's the recommended initial settings for Android system components with UID 0, like DNS, GPS, ANDROID etc?

[onetimecontributor]

There are few Android system components (?apps) with UID 0 like DNS, GPS, ANDROID, etc

What's the recommended initial setting that one can start from?
For example, in my case, I've managed to use my system with the following:

1. DNS - blocked, no IP rules, no Domain rules. that's with "prevent dns leaks" set to ON. What may be the caveats here that I'm not seeing so far?
2. GPS - bypass universal firewall rules . Otherwise I couldn't get my GPS working. Please advise if I can somehow restrict it further. I think I've tried to isolate it and whitelist it's domain rules ()
3. ANDROID - Allowed, please advise how can I restrict it without breaking the system, as it's contacting DNS 8.8.8.8 and looks like routes some requests. I think I've tried to spent few minutes trying to isolate + domain rules, but it didn't work out so I gave up back then. It may have been related to push notifications but I'm not sure
4. Samsung-specific (ApexService + 77 other apps listed as single app, no per-app setting) - Isolate, had to whitelist *.glpals.com, time.android.com, *.pool.ntp.org

it's a fork from #1751 as it's rather separate discussion

[onetimecontributor]

anyone, please?

[onetimecontributor]

ok, to share useful findings from other threads:
in order for messaging apps to work via push (Whatsapp etc), one need to isolate particular "system" :) components, according to input from @BienGudBoy here #1187 (comment)

Works on mine (with advanced DNS filtering as well). You have to whitelist some domains for Play Services/Framework for push notification to work.

After multiple trial and error (pain), android.apis.google.com android.googleapis.com mtalk.google.com are the domains you need. Also, make sure firebaseinstallations.googleapis.com is whitelisted on the app you need push notification with GMS.

I got Proton Mail and Signal push notification working with this. I did have to wipe app data to "reset" the Play Services status in Signal, so maybe you can give it a try (after whitelisting these domains)?

I've tested it and it has solved my issues. Will keep collecting useful findings from others here. And ask others to do the same, please

[BienGudBoy]

@onetimecontributor

1. DNS: I don't have it on my phone (running Android 13), so I can't test.
2. Isolate. (for my phone, it is sfepodownload.mediatek.com and supl.google.com)
3. Just block. In my case, my phone uses system updates from GMS, which then I have to allow it before starting a system update (for some reasons it uses ANDROID to download the update), then when it finishes updating, blocks it. It might be different on other devices tho.
   Isolate could be possible, but unfortunately my phone no longer has software updates anymore, thanks MTK
4. In my experience Samsung devices phones home quite a lot, so it's better to block all by default, unless you encounter errors, which then trial and error is the key again.

[luckygitt]

What's the recommended initial setting that one can start from?

Well, my recommended action is to block everything, then unblock as necessary.
For your info, I have DNS, Android, GPS blocked - in fact I have everything blocked except Apps that I've installed.
The only exception is one Isolated App, Google Play Services (along with the linked GSF) - 6 domains, mainly to enable push notifactions to work).,

[onetimecontributor]

my own update, tnx @BienGudBoy

1. DNS - blocked, no IP rules, no Domain rules. that's with "prevent dns leaks" set to ON. Seems Ok
2. GPS - isolated. Had to whitelist *.glpals.com (it's gps chip manufacturer, i think, doesn't work w/o it). supl.google.com - blocked, can't change agps addr, but I get faster GPS lock if I run GPSTest from f-droid.
3. ANDROID - blocked
4. Samsung-specific (ApexService + 77 other apps listed as single app, no per-app setting) - Isolate, had to whitelist only *.pool.ntp.org
5. GSF - isolated, but had to add circa 20 domains as an exception for GPay, pushes and generic gstatic (fonts, etc)

[BienGudBoy]

For supl.google.com, do you notice worse GPS lock as well? It might be because I disabled GMS, but I'm looking for solutions without having to use it on my phone (it can't be rooted nor bootloader unlocked unfortunately)

[onetimecontributor]

For supl.google.com, do you notice worse GPS lock as well? It might be because I disabled GMS, but I'm looking for solutions without having to use it on my phone (it can't be rooted nor bootloader unlocked unfortunately)

I do. So far I'm using GPSTest to get proper lock (not yet automated)