29

Background

"Google Play services for Instant Apps" has installed itself onto my device without my permission. It broke functionality of my firewall (AFWall and couple of other apps). And it is updating itself and other apps/components without permission. When I uninstall this component, it downloads itself again and installs right back. (That is, most likely it is "Google Play services" that's actually doing this in the background)

There are no confirmations and no notifications of anything downloading, updating, or installing. The way I discovered it was by noticing that some functionality of my apps was changed/broken. So I used an app ("System Info for Android") and it shows that in fact this "Google Play services for Instant Apps" was installed a day ago.

My question is: how do I completely disable unauthorized updates of an Android device, yet preserving the following functionality:

  • Contacts Sync
  • Google Play Store
  • Google Maps App

In these screenshots, you can see that all settings responsible for automatic updates are switched off. Therefore this download and installation is clearly unauthorized and should not be happening. The screenshot of Instant Apps setting shows up after the thing is already installed. Leaving just the global setting from Google Play Store.

enter image description here
Settings › Apps // Settings › Google › Instant Apps (turned OFF!) // Play Store Settings (Auto Update turned OFF!)

It has all started after I followed a misleading suggestion, you can see in this screenshot, to update "Google Play services":

enter image description here
click image for larger variant

Update 1:

What I've discovered so far is that something (most likely "Google Play Services") is requesting the download + install. The way it's doing it is placing the request with Google Download Manager. Unclear what triggers it, but if watching device closely an icon from Download Manager does show up in notification indicating download percentage. However, upon completion, it instantly disappears. Still, there is nothing indicating installation.

What I've tried so far:

  1. Install the following as user-level instead of system-level apps that they are originally: Google Account, GP Store, and Service Framework (com.google.android.gms; com.android.vending; com.google.android.gsf) This didn't work. The download is still requested and subsequently, installed.
  2. Seems any way of blocking installation will make it download again and again (until your data is used up). So most likely best approach would be to prevent the downloading in the first place. I wasn't able to install Download Manager as a user app, which seems the part that needs to be controlled.
  3. Blocking Download Manager and/or Play Store via firewall is possible, but that breaks down the only trustworthy way of downloading apps.

Update 2:

Downgrading to the previous version of GP Services (v11.3.02) worked for a few days, but today GP services for Instant Apps was downloaded and installed. So, doesn't matter which version you use. Most likely Google will update all phones this way regardless.

Update 3:

So now Google is updating itself on regular basis pretty much whenever it feels like it. If I'm streaming a movie, crippling my speed, using up my internet bandwidth for which I pay money per MB. In this image you can see 3 Google apps were updated without permission.

enter image description here

Community
  • 1
Emil
  • 792
  • 2
  • 7
  • 19

3 Answers3

7

Update: In recent android versions you can do it from Settings -> Google -> Instant Apps -> OFF.

Original answer follows below:

In the best case scenario this should be enough to block Instant Apps from auto-updating.

Run on device via a terminal (connectbot, juicessh, etc).

pm hide com.google.android.instantapps.supervisor

Or, if running via adb on a pc while connected via cable (or wifi adb), then use:

adb shell pm hide com.google.android.instantapps.supervisor

Unlike pm disable pm hide also works on non-rooted devices. So far, I didn't see any more Instant Apps notifications appearing.

If the above does not work for you then another approach would be modifying the SELinux context of the file/folder (e.g. with chcon).

To revert the pm hide command above use:

pm unhide com.google.android.instantapps.supervisor
ccpizza
  • 530
  • 9
  • 15
  • Well, that would target that particular app, but I'd like to block all unauthorized updates or installation of new apps. Also, this sort of "system-level" installation and download happens hidden from user. The way it works is, it checks version and if it needs to be upgraded it downloads a file behind the scenes. Once the download is complete it attempts to do install and if installation fails it will try again at another time. The temp files are periodically deleted, so if it can't find it... it'll download it again. If you monitor temp folder you can catch it doing this over and over... – Emil Nov 12 '17 at 16:54
  • @Emil: isn't com.google.android.instantapps.supervisor the app that is doing the monitoring you mention? Or is it some specific service from google play services? If it is the second then I guess the recipe is not complete. I've also denied the package permission to run in the background and start at boot. – ccpizza Nov 12 '17 at 17:15
  • I couldn't pinpoint exactly what does the monitoring. On Android there's a system of setting up listeners and there are couple of apps that claim to adjust those but they proved to be ineffective. I couldn't find a way to access/control this "queue" directly or to intercept it somehow. Basically everything Google considers as core, can go around the settings for ordinary apps – Emil Nov 12 '17 at 17:54
3

As the name suggests, it's part of the Google services apps. PlayStore uses it to run apps without installing them (new service). It is possible to disable but not remove (as far as I know it will just keep installing it self as being part of the core services).

To disable, go to Settings › Google › Instant Apps and switch the toggle switch (Reference).

I believe this will be a system app on newer devices as they come out, for the rest of us with older devices they will just force install on compatible devices.

Edit: Due to the fact the question was amended after I answered. This answer applies to none rooted devices. With a rooted device it could be possible but I can't think of a solution that's easy or permanent.

Izzy
  • 91,166
  • 73
  • 343
  • 943
Josue Rivera
  • 102
  • 5
  • Let us continue this discussion in chat. – Josue Rivera Aug 07 '17 at 16:11
  • @Emil I've just cleaned up all comments except the link to your chat (where the comments are still available). Further, I cannot agree with you that this is not an answer: in your question you wrote "there seems to be no easy way to permanently disable" and "My question is: how do I disable this functionality entirely" – which is what Josue presents in this post: "To disable go to Settings, Google, Instant Apps and switch the toggle switch." If you have done so and it didn't work, please state that. – Izzy Aug 07 '17 at 23:03
  • @izzy thanks, my concern was/is pretty much that the Answer is a duplicate of the (portion) of Question. I just don't see the point of sending readers to a different page: "To disable, go to Settings › Google › Instant Apps and switch the toggle switch (Reference)" When it's right there in the question with a screen shot even. It deters from the question because people think that it is already answered. – Emil Aug 08 '17 at 04:24
  • @Emil Ah, looks like I didn't identify that screenshot. To make that clear to others, I've edited your post (hope my adjustment is OK with you?) // Josue: In this context I fully agree with Emil, this is not answering the question but repeating part of it with your own words. Looks to me that despite of those steps performed, that "app" still auto-updates and, even when disabled, breaks functionalities in other apps (which part you didn't even address). So despite of your post having been upvoted (no idea who did that), I suggest you remove it. – Izzy Aug 08 '17 at 09:16
  • @Izzy his original question was if it was possible to completely disable without root. My answer is no. "It is possible to disable but not remove (as far as I know it will just keep installing it self as being part of the core services)." I go on explaining why. I affirmed that it is indeed not possible to remove because it's part of play services. So I do believe I did answer his question. I added some references for anyone else that might need it. He later amended his question to add the possibility of root which I amended my answer that I couldn't think of a easy/permanent to do it. – Josue Rivera Aug 08 '17 at 13:16
  • 1
    Anyway I'm done trying to explain this. He asked a question, I basically said no, explained why and gave information for anyone else that might find themselves in similar situations. Question was changed, I edited to express that my answer applied to original question. If I misunderstand how rules work here delete my answer and let me know how I can do better. – Josue Rivera Aug 08 '17 at 13:24
  • 1
    @JosueRivera leave that be if you are satisfied you are not at wrong. If the answer is wrong folks can downvote it and move on. – Firelord Aug 08 '17 at 13:50
  • 1
    It auto-updates even when set to off. I shut it off over a month ago and it auto-updated again today. – tgf Dec 08 '17 at 02:25
1

About: [Root Only] This solution involves blocking write access to the temp (cache) folder where Google downloads its system apps such as Google Play Services, Google Play services for Instant Apps, etc. It's simpler than it looks, because I'm explaining everything, it looks like a lot. Afterwards, installing new apps essentially becomes 3 steps and the process is similar to installing programs on a PC.

Background: Under my system the folders work as follows:

1) /data/data/com.android.providers.downloads/cache
* This is the folder where Google system updates (as well as New system apps) are installed.
* Unfortunately, this folder is also used for downloading normal new apps. So you can't just block it permanently. You have to be able to block/unblock it when downloading new apps.

2) /mnt/sdcard/Android/data/com.android.vending/files
* This folder is used to update normal (non Google-system apps). So no need to block this, or do anything special when it comes to updating your normal apps like Facebook, games etc.

Solution: The cache folder above is kept locked during normal operation. When you want to install a new app, overall process is as follows (although mostly automated): (1) unlock cache folder (2) lock app folders, in case it sneaks through while it's unblocked and installs it. (3) Download your new app from the store (4) Copy downloaded program from installation folder to another place, and rename it from default name (download.apk) (5) Clear and lock cache folder (6) unlock the apps folders (7) Click on the apk file to install it.

Obviously you don't want to type this at the terminal every time so these are automated steps. They involve using two additional apps as well as having BusyBox installed (to be able to use chattr command by the scripts)

  1. Locking unlocking is achieved by an app called Gscript. You can use any other app that achieves execution of scripts. There's a version in google store, but it crashes for me and other people. There's a stable fork available here: https://bitbucket.org/Equidamoid/gscript (Thanks to author's post here: https://stackoverflow.com/a/20328927/7609435) Just paste these two scripts there. (Both need SU)

    A) Execute before download - Lock apps / Unlock cache

    chattr +i /data/data/* chattr +i /data/data chattr +i /data/app/* chattr +i /data/app chattr -i /data/data/com.android.providers.downloads/cache

    B) Execute after download is complete and after you copied the file - clear and lock cache / unlock apps

    rm /data/data/com.android.providers.downloads/cache/* chattr +i /data/data/com.android.providers.downloads/cache chattr -i /data/data/* chattr -i /data/data chattr -i /data/app/* chattr -i /data/app

  2. You will know the app is downloaded when the Play Store says "download failed". It'll say that because it couldn't install the apk, but it was actually successful downloading and it is sitting inside the cache folder. Before running script (B) above, you have to move the file from cache folder elsewhere. You can do it using any app of course, but I like to use Total Commander, because it can have two panes and it supports bookmarks (I added cache to it). So move it and rename the file from default name to something else and then run the (B) script above. Also note, when copying the APK it should have an icon of the app. If it has the default icon it's probably corrupt download due to other unrelated reasons, so you can try downloading again.

  3. Now the cache folder is cleared and locked and apps folders are unlocked. (you can double check that cache folder is empty just to be 100% sure but I doubt this is necessary) You can now install the APK you downloaded.

Note1: If you click on a new download and it says "pending" just (force) close Google Play and restart it, it should start downloading automatically.

Note2: I have tested this with only Android: 6.0.1 / MIUI: 8.5.3.0 so this solution might not be universal. Check to see if you have the cache folder and if the download of the Google Play Services is being uploaded there (once upload is finished it stays there for a while).

WARNING: It's fine to keep cache folder locked up, but if you happen to restart your phone while those data folders are locked, your phone will not boot. And you'll need to go manually and change it from TWRP shell.

P.S. I understand this solution is not for everyone, but if your primary concern is stability and to keep data-usage under control, this works... for now. Hopefully someone will come up with a better answer than this.

Emil
  • 792
  • 2
  • 7
  • 19
  • Disclaimer: Now that your phone is no longer automatically updated, if there is a vulnerability with previous Google system you could be exposed. However, personally, I consider a vulnerability when something can be installed without explicit permission. – Emil Oct 01 '17 at 20:28