What's the recommended initial settings for Android system components with UID 0, like DNS, GPS, ANDROID etc?

[onetimecontributor]

There are few Android system components (?apps) with UID 0 like DNS, GPS, ANDROID, etc

What's the recommended initial setting that one can start from?
For example, in my case, I've managed to use my system with the following:

1. DNS - blocked, no IP rules, no Domain rules. that's with "prevent dns leaks" set to ON. What may be the caveats here that I'm not seeing so far?
2. GPS - bypass universal firewall rules . Otherwise I couldn't get my GPS working. Please advise if I can somehow restrict it further. I think I've tried to isolate it and whitelist it's domain rules ()
3. ANDROID - Allowed, please advise how can I restrict it without breaking the system, as it's contacting DNS 8.8.8.8 and looks like routes some requests. I think I've tried to spent few minutes trying to isolate + domain rules, but it didn't work out so I gave up back then. It may have been related to push notifications but I'm not sure
4. Samsung-specific (ApexService + 77 other apps listed as single app, no per-app setting) - Isolate, had to whitelist *.glpals.com, time.android.com, *.pool.ntp.org

it's a fork from #1751 as it's rather separate discussion

[onetimecontributor]

anyone, please?

[onetimecontributor]

ok, to share useful findings from other threads:
in order for messaging apps to work via push (Whatsapp etc), one need to isolate particular "system" :) components, according to input from @BienGudBoy here #1187 (comment)

Works on mine (with advanced DNS filtering as well). You have to whitelist some domains for Play Services/Framework for push notification to work.

After multiple trial and error (pain), android.apis.google.com android.googleapis.com mtalk.google.com are the domains you need. Also, make sure firebaseinstallations.googleapis.com is whitelisted on the app you need push notification with GMS.

I got Proton Mail and Signal push notification working with this. I did have to wipe app data to "reset" the Play Services status in Signal, so maybe you can give it a try (after whitelisting these domains)?

I've tested it and it has solved my issues. Will keep collecting useful findings from others here. And ask others to do the same, please

[BienGudBoy]

@onetimecontributor

1. DNS: I don't have it on my phone (running Android 13), so I can't test.
2. Isolate. (for my phone, it is sfepodownload.mediatek.com and supl.google.com)
3. Just block. In my case, my phone uses system updates from GMS, which then I have to allow it before starting a system update (for some reasons it uses ANDROID to download the update), then when it finishes updating, blocks it. It might be different on other devices tho.
   Isolate could be possible, but unfortunately my phone no longer has software updates anymore, thanks MTK
4. In my experience Samsung devices phones home quite a lot, so it's better to block all by default, unless you encounter errors, which then trial and error is the key again.