com.google.android.apps.work.oobconfig Copy

"Device setup", a Google system app. On Pixel phones it implements carrier SIM locking: independent security research describes it querying Google's servers after the device connects to Wi-Fi during setup to learn whether the device should be SIM locked, caching that state, and allowing or denying new SIM and eSIM installs accordingly. Our sample records it mostly on Pixels but also on a handful of other makes (CipherLab, HMD Global, Lenovo, realme, Sony, TCL and others) at API 27 to API 30. Where this site holds signer data, which is for the Google and HMD Global devices, it is Google-signed. Its role on the non-Pixel devices could not be sourced. An AOSP PackageManagerService change from September 2022, "forbid deletion of protected packages", uses this exact package as its test case: before the change it could be removed with "pm uninstall --user 0", and after it the removal fails. The Pixel-focused research above reports that on Pixels it can no longer be disabled from Settings or over ADB either, only with root. Version note: that protection landed in AOSP in September 2022; which Android release first shipped it could not be sourced, and the non-Pixel observations here (API 27 to API 30) predate it, so whether they are protected, and what the app does on them, could not be established. The "work" and "oobconfig" parts of the package name suggest an out-of-box enterprise configuration role, but no Google source connecting it to zero-touch enrolment was found, so that should not be assumed. For Android Enterprise, EMM and kiosk fleets, no documented reason to disable it was found. On Pixels it enforces the carrier SIM-lock state and the platform blocks its removal, so leave it in place; on other makes, test before touching it given its unsourced role there.

• [pm] forbid deletion of protected packages - platform/frameworks/base commit →
• Bypassing SIM Lock on Pixels - Alex Wang's Blog →
• Package provenance for com.google.android.apps.work.oobconfig - Android System App Database →

• Signed by Google's own signing key (the same key Google uses across devices), so it is a Google-provided preinstall that updates independently of the system image, though 2 different Google signing keys appear across the fleet. This certificate spans 12 device makes - the hallmark of a globally distributed Google key.
• Its largest observed manifest declares 18 permissions: 1 runtime (user-granted), 7 signature or system-level, 7 install-time and 3 vendor or uncatalogued.
• APK size ranges from 2.0 MB to 12.2 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.