[ISSUE] Unable to find packages of other users. (multiuser)

[edwining01]

Describe the bug
Unable to find packages of other users from PackageManager either with or without Enable multi-user support. Expected showing 2 and more for apps like google play store and unique apps of some secondary users.

Firewall Logs
N/A (not related)

Smartphone (please complete the following information):

• Device: POCO M3
• Android OS: Phh-Treble AOSP 11

Additional context

I tried the following steps with adb

The following only can get packages of primary user, but none from the others:

pm list packages

Find user id here:

ls /data/user

And apply here can found packages of that user:

pm list packages --user <userId>

I can find people use pm list packages worked in the past. Is that changed on android 11?

[intika]

Afwall is lacking support of real multiuser :( it does support work profile but does not show app of other users (other than work profile) testing on android 11 (lineage)

[infinity0]

The problem is here https://github.com/ukanth/afwall/blob/beta/app/src/main/java/dev/ukanth/ufirewall/Api.java#L1402 and stems from the fact the Android API (as available to apps) does not let you get all users.

One way to solve this is to call pm list users directly, just like afwall already calls pm list packages -U --user directly for work profile users here: https://github.com/ukanth/afwall/blob/beta/app/src/main/java/dev/ukanth/ufirewall/Api.java#L1678

I can code this up if you're willing to accept it, @ukanth ?

[infinity0]

To be honest, I think it would be simplest to rip out all the existing code for work profiles and just list all packages for all users together in the main UI. Output of pm list packages -f -U looks like, e.g.:

package:/system/app/EasterEgg/EasterEgg.apk=com.android.egg uid:10079,1010079,1110079

This suggests the uid for app base uid X with user Y is just Y * 100000 + X. Not sure if this is always the case, but if not then we can also iterate through pm list users and run pm list packages -f -U --user $user instead.

Thoughts @ukanth ?

[infinity0]

pm list packages -U -f even works without root for me on LineageOS 20 and correctly shows packages that are installed only for other users (and not for user 0, which is what adb effectively runs as).

[ukanth]

The problem is here https://github.com/ukanth/afwall/blob/beta/app/src/main/java/dev/ukanth/ufirewall/Api.java#L1402 and stems from the fact the Android API (as available to apps) does not let you get all users.

One way to solve this is to call pm list users directly, just like afwall already calls pm list packages -U --user directly for work profile users here: https://github.com/ukanth/afwall/blob/beta/app/src/main/java/dev/ukanth/ufirewall/Api.java#L1678

I can code this up if you're willing to accept it, @ukanth ?

Please make a PR. I will look into it.

[infinity0]

@ukanth Are you happy for me to replace (i.e. delete) the existing code relating to work profiles? It adds complexity to the logic, and I do not have the feature on my own phone so I cannot test it.

If I understand correctly work profiles should "just work" if proper multiuser support is implemented, since work profiles are just implemented as another user.

[infinity0]

I have a basic version up and the basic iptables functionality works, there is a big UI problem. For applications not installed on the user AFWall is running as, there is no simple way to get (1) the application common name (2) the application icon, because these two things are done through the Android API - which as mentioned doesn't allow access to other users.

I've done a web search but it seems:

1. to get the application common name via adb requires bundling a binary copy of aapt, to get it from the APK
2. there will be similarly dirty hacks needed to grab the icon, and we'll have to figure it out as it seems nobody on the net has needed to do this yet.

If anyone has some tips, such as other apps which have similar functionality, please let me know.

[infinity0]

The problem is solved by copying what LSPosed does, with some slight differences as AFWall only has su/libsu and cannot rely on Magisk Module functionality like LSPosed. See PR for details.