com.android.networkstack.tethering.overlay Copy

The AOSP-named Runtime Resource Overlay (RRO) for the Tethering module, and the sibling of com.google.android.networkstack.tethering.overlay documented separately on this site. It is configuration rather than an app: it carries no code, has no launcher entry in any observation recorded here, and is between about 8.5 KB and 12.7 KB in size. Most devices report it with the label TetheringResOverlay, a few with the raw package name, and several with TetheringConfigOverlayGsi. The Gsi suffix conventionally marks a generic system image build, but nothing consulted here confirms what distinguishes that variant, so treat the label as an observation rather than an explanation. The Tethering module ships as an APEX, so per-device values reach it through an overlay installed on another partition instead of by editing the module itself. The module declares an overlayable set named TetheringConfig with a product, system or vendor policy, and an overlay may redefine the values in it: the interface name patterns for USB, NCM, Wi-Fi, WiGig, Wi-Fi Direct and Bluetooth tethering, the USB tethering functions, the DHCP range handed to tethered clients, the upstream type list and whether upstream selection is automatic, the eBPF offload and legacy DHCP server switches, the Wi-Fi Direct dedicated IP and subnet prefix settings, the offload poll interval, and the carrier hotspot entitlement and provisioning configuration. AOSP's emulator build carries a worked example of the same component: device/generic/goldfish/rro_overlays/TetheringOverlay declares the package name com.android.networkstack.tethering.emulator and sets android:targetPackage to com.android.networkstack.tethering, android:targetName to TetheringConfig, android:isStatic to true and android:priority to 0. The target name there is the AOSP-named module, which is the point of difference from the Google-named overlay: on a device carrying Google's build of the module the target is com.google.android.networkstack.tethering instead. This site records a package's own name rather than the targetPackage inside its manifest, so which of the two a given device's overlay targets cannot be read from here. The documentation inconsistency covered in the entry for the Google-named overlay applies equally here: AOSP's Tethering page states that the module does not support customisation while the same module ships the TetheringConfig overlayable that packages of this name exist to target. Provenance fits an overlay built into each device image. In our sample it carries 11 distinct signing keys, all classified as OEM keys and all but one of them also signing the framework on their devices, across Motorola, OUKITEL, TCL, ANT DAO Technology, vivo, Xiaomi, NUU and OPPO. It appears on 41 devices across 24 makes, weighted towards budget and ODM-built hardware rather than towards Samsung or Pixel. The only permission it declares is POST_NOTIFICATIONS, which a code-free overlay has no obvious use for; the Google-named sibling reports the same single permission, so it looks like a property of how these overlay APKs are built or recorded, but no source consulted accounts for it. Version note: the Tethering module (com.android.tethering) is in APEX format and is available for devices running Android 11 or higher, and from Android 12 the ConnectivityService code was added to the same APEX, widening the module's scope. This overlay therefore belongs to the Android 11 and later module layout. The version names recorded here run from "12" to "14", with target SDK 31 to 34 and observations from API 30 through API 36. Those version names match the numbering of Android releases, but no source consulted says what they represent, so do not read them as an overlay version or as the platform release of the build the copy came from. For Android Enterprise, EMM and kiosk use it has no role in enrolment or policy. It is part of how the platform learns which interfaces on this hardware are tethering interfaces, so disabling or removing it risks breaking hotspot and USB or Bluetooth tethering rather than locking them down. To stop users sharing the connection, use your EMM's tethering and hotspot restrictions and leave this package in place.

• Tethering - Android Open Source Project →
• Change the value of an app's resources at runtime (RROs) - Android Open Source Project →
• Tethering overlayable.xml, TetheringConfig (packages/modules/Connectivity) - Android source →
• TetheringOverlay AndroidManifest.xml (device/generic/goldfish) - Android source →
• Package provenance for com.android.networkstack.tethering.overlay - Android System App Database →
• Package provenance for com.google.android.networkstack.tethering.overlay - Android System App Database →

• Re-signed by each device maker with its own platform key - 11 different certificates appear across 8 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 1 permissions: 1 runtime (user-granted).
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.