com.google.android.networkstack.overlay Copy

A small resource package in Google's namespace whose label varies by device: this site records GoogleNetworkStackResOverlay, NetworkStackOverlay, NetworkStackGoogleResOverlay, or the bare package name in place of a label. It has no launcher entry, no observation here is user-facing, none is Play-eligible, its aggregated permission set holds a single entry, POST_NOTIFICATIONS, and builds are recorded between roughly 8.5 KB and 74.1 KB. This site aggregates permissions across observations rather than per build, so which builds request that permission cannot be established. The name and labels describe a Runtime Resource Overlay (RRO), which AOSP defines as a package that changes the resource values of a target package at runtime, and which cannot carry code. The labels point at the Google-signed NetworkStack module, which this site records as com.google.android.networkstack with the label "Network manager". On 34 of the 36 devices that record this overlay, this site also records that module, which is consistent with it being the overlay's target, though the target is inferred from naming rather than confirmed. On 30 of the 36 devices it is recorded alongside the AOSP-keyed overlay com.android.networkstack.overlay, so on those devices the two overlays coexist rather than one replacing the other. What an overlay of NetworkStack may set is published by the module itself. AOSP describes Network Stack as an updatable Mainline module that ensures Android can adapt to evolving network standards, naming captive portal detection and login code as an example, and its components include the DHCP client and NetworkMonitor, which tests for internet reachability, detects captive portals and validates networks. The module declares an overlayable named NetworkStackConfig, whose entries include the captive portal HTTP and HTTPS probe URLs and their list and fallback forms, the DNS probe timeout, the regular expressions used to judge whether a validation probe succeeded or failed, the default DNS servers, and DHCP client hostname options. Which of these values this package sets on any build could not be sourced. Provenance: despite the Google namespace, none of the signing certificates recorded for it here is classified as Google's. Among the observations that carry signing data, 10 distinct certificates are recorded, each classified as the device maker's own key, covering Motorola, Lenovo, OPPO, vivo, Xiaomi, NUU, OUKITEL and ANT DAO TECHNOLOGY LIMITED; eight of the ten are recorded as also signing the Android framework, a platform-level key. The package is seen across 20 device make names in this sample, including TCL, OnePlus, realme, Infinix and Blackview. Version note. Observations here run from API 30 to API 36, version names run from 12 to 15, and this site's target SDK roll-up reports 31 to 35. Those are independent roll-ups across observations rather than a per-build pairing, so they cannot say which target SDK a given device carries. AOSP documents the module it appears to accompany as updatable through Mainline. Whether the values this overlay sets have changed across Android releases could not be sourced. For Android Enterprise, EMM and kiosk use it has no identified enrolment or policy role in the sources cited here and nothing a user interacts with. If it overlays NetworkStack as its name indicates, the captive portal probe URLs are the entries worth knowing about on a managed or filtered network, since they decide which endpoint the device contacts when judging whether a network has internet access. If this package overrides them, disabling it could change the endpoints used for validation; the resulting values would depend on the module defaults and any other enabled overlays, and this package's actual overrides could not be sourced. No hardening benefit from disabling it is established by the cited sources. Where kiosk mode is stopping a captive portal login from appearing, the documented fix is to allow the captive portal login package in the EMM policy rather than to touch this package.

• Network Stack - Android Open Source Project →
• Change the value of an app's resources at runtime (RROs) - Android Open Source Project →
• NetworkStack overlayable.xml (packages/modules/NetworkStack) - Android source →
• Kiosk devices and captive portals - Android Enterprise FAQ →
• Package provenance for com.google.android.networkstack.overlay - Android System App Database →
• Package provenance for com.google.android.networkstack - Android System App Database →
• Package provenance for com.android.networkstack.overlay - Android System App Database →

• Re-signed by each device maker with its own platform key - 10 different certificates appear across 8 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 1 permissions: 1 runtime (user-granted).
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.