SettingsFirewall

SettingsFirewall only intercepts accesses to system settings.

What is intercepted:

• Android Settings APIs (e.g., android.provider.Settings).
• Shell commands like /system/bin/settings get.

What is NOT intercepted:

• System properties (e.g., android.os.SystemProperties APIs, __system_property_get, or getprop).
• Other system APIs that do not fall under the Settings provider category.

SettingsFirewall is an Xposed module designed to intercept and block apps from accessing Android system settings (such as Settings APIs or /system/bin/settings get).

Requirements

• Android 4.3+ devices.
• A root-based Xposed framework installed.
• Note: Rootless frameworks like LSPatch, VirtualXposed, or TaiChi-Ying are not supported because the module must hook system components.

Configuration by Framework

Depending on your Xposed implementation, you must select the correct scope:

• LSPosed: Select only System Framework and reboot.
• Dreamland: Select Settings Provider (com.android.providers.settings) and reboot.

Use App.getSortedList(Context context, ISettingsFirewall service) to get a list of all installed applications that are eligible for firewalling.

This method:

• Filters out system core processes (UID < Process.SHELL_UID) and the module's own UID.
• Handles sharedUserId by grouping them as a single entry.
• Determines if an app is currently targeted by the firewall by checking its UID against service.getTargets().
• Returns a List<AppInfo> sorted by the AppInfo.COMPARATOR.

List<AppInfo> appList = App.getSortedList(context, service);
for (AppInfo info : appList) {
    // info.name, info.icon, info.enabled, info.uid, info.isSharedUid
}

To interact with the SettingsFirewall engine, you must obtain an instance of ISettingsFirewall. This is done via the App.getService(Context context) method, which retrieves the service from the SettingsProviderHook using a ContentResolver call to the Settings authority.

Note that the service is a Binder interface (ISettingsFirewall.Stub.asInterface) provided by the system provider.

ISettingsFirewall service = App.getService(context);

To see which settings are being intercepted or replaced for a specific application, use App.getSettings(ISettingsFirewall service, int uid).

This method queries the service for replacements associated with the provided UID and categorizes them into three groups based on the Settings provider type:

• Settings.System (marked with Replacement.FLAG_SYSTEM)
• Settings.Secure (marked with Replacement.FLAG_SECURE)
• Settings.Global (marked with Replacement.FLAG_GLOBAL)

It automatically filters out internal keys that have been moved between these providers (e.g., MOVED_TO_SECURE, MOVED_TO_GLOBAL). The returned List<Replacement> is sorted by Replacement.COMPARATOR.

List<Replacement> replacements = App.getSettings(service, targetUid);
for (Replacement r : replacements) {
    // r.key, r.value, r.flag
}