com.android.networkstack.overlay Copy

NetworkStackOverlay, a Runtime Resource Overlay (RRO) that supplies device-specific configuration to the NetworkStack module rather than an app in its own right. An RRO changes the resource values of a target package at runtime without altering the target's code, which is how a build customises a module it cannot edit. NetworkStack ships as an updatable module covering IP services, DHCP, network validation and the captive portal login flow, so per-device values reach it through an overlay installed on the product, system or vendor partition. What it can set is documented in the module's own overlayable declaration. The NetworkStack module declares an overlayable named NetworkStackConfig, and an overlay of this kind may override the values in it: the captive portal HTTP and HTTPS probe URLs and fallback URL lists, the DNS probe timeout, the regular expressions used to decide whether a validation probe succeeded or failed, whether multiple HTTP and HTTPS probe URLs are tried serially rather than together (config_probe_multi_http_https_url_serial), the default DNS servers used by the DHCP client, and whether the DHCP client sends a hostname option. The captive portal probe URLs are the entry worth knowing about on a managed network, since they determine which endpoint the device contacts to decide whether a network has internet access. The naming and signing are both varied, which is normal for this component. Labels seen in this site's sample include NetworkStackOverlay, NetworkStackResOverlay and NetworkStackOverlayGsi, the last being the variant that ships with a Generic System Image rather than a device build. It is seen both Google-signed and signed by the device maker's own platform key across Xiaomi, Motorola, OPPO, NUU, OUKITEL and others, and it is observed from API 30 through API 37, so it is not tied to one Android release. It has no launcher icon and is not user-facing. The AOSP-keyed name recorded here is com.android.networkstack.overlay; it pairs with the module itself, which this site records under the Google-signed name com.google.android.networkstack. For Android Enterprise, EMM and kiosk use it has no role in enrolment or policy, but it is part of how the platform decides whether a network is usable. Disabling or removing it does not harden anything: it removes the build's connectivity configuration and risks breaking network validation and the captive portal flow. Where kiosk mode is preventing a captive portal login from appearing, the supported fix is to allowlist the captive portal login package in the EMM application policy rather than to remove this overlay.

• NetworkStack module - Android Open Source Project →
• Change the value of an app's resources at runtime (RROs) - Android Open Source Project →
• NetworkStack overlayable.xml (packages/modules/NetworkStack) - Android source →
• Kiosk devices and captive portals - Android Enterprise FAQ →
• Package provenance for com.android.networkstack.overlay - Android System App Database →

• Signed by Google's own signing key (the same key Google uses across devices), so it is a Google-provided preinstall that updates independently of the system image, though 14 different Google signing keys appear across the fleet.
• Its largest observed manifest declares 1 permissions: 1 runtime (user-granted).
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.