com.google.android.tetheringentitlement Copy

Recorded as "Tethering Entitlement", this is a Google package that appears to perform carrier entitlement checks for mobile hotspot (tethering). The system configuration file nexus.xml, in the copy extracted into the redfin device directory of the TheMuppets proprietary_vendor_google tree cited here, lists this package and describes it in a comment as the "Tethering entitlement check app", allowlisting it to run a JobIntentService in the background while the device is in power save (except idle) and Internet access in the background while data saver is on. AOSP's Tethering module configuration describes the mechanism such an app plugs into: where the mobile hotspot feature "requires provisioning", a provisioning app can be named for the UI check and a no-UI broadcast check, with a recheck period that defaults to 24 hours. The AOSP default leaves those slots empty, and no cited source shows which value Pixel builds set, so the tie between this package and those slots rests on its label, the nexus.xml comment and its permissions, and is an inference. On this site it is recorded on Google Pixel phones and on some NUU, Nothing and Unihertz devices, on devices reporting OS API levels 31 to 37. Where this site holds signer data, which is 3 of those 4 makes (Google, NUU and Nothing), it is signed by Google keys that do not sign the Android framework, and this site records two distinct signing keys for it. This site records it requesting TETHER_PRIVILEGED, CONNECTIVITY_USE_RESTRICTED_NETWORKS, WRITE_APN_SETTINGS, READ_PRIVILEGED_PHONE_STATE and INTERNET, among others. This site aggregates permissions across observations rather than per build, so which builds declare each of them cannot be established. Version note: AOSP documents that the Tethering module, which includes the "interaction with tethering entitlement", is the updatable com.android.tethering APEX available for devices running Android 11 or higher, and that from Android 12 all of packages/modules/Connectivity is in the module's scope. That describes the platform side; whether this package's own role changed across those releases could not be sourced. The nexus.xml copy cited here is from that tree's lineage-19.1 branch, a single snapshot, so it does not show whether later builds configure the package the same way. For Android Enterprise, EMM and kiosk use this package is not a management control. If it is the entitlement checker its label and the nexus.xml comment indicate, it acts for the carrier rather than for the organisation, and disabling it could affect whether hotspot can be turned on where the carrier requires an entitlement check; that effect was not verified here. To restrict tethering, the Android Management API's deviceConnectivityManagement tetheringSettings field is the documented lever: DISALLOW_ALL_TETHERING is documented as supported on fully managed devices and work profiles on company-owned devices on all supported Android versions, and DISALLOW_WIFI_TETHERING on company-owned devices running Android 13 and above.

• nexus.xml (redfin, lineage-19.1) - TheMuppets/proprietary_vendor_google, GitHub →
• Tethering/res/values/config.xml - AOSP packages/modules/Connectivity →
• Tethering - Android Open Source Project →
• Policy resource (DeviceConnectivityManagement) - Android Management API →
• Package provenance for com.google.android.tetheringentitlement - Android System App Database →

• Signed by Google's own signing key (the same key Google uses across devices), so it is a Google-provided preinstall that updates independently of the system image, though 2 different Google signing keys appear across the fleet. This certificate spans 3 device makes - the hallmark of a globally distributed Google key.
• Its largest observed manifest declares 11 permissions: 4 signature or system-level, 4 install-time and 3 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.