SystemUI: authenticate before disabling airplane mode - #437
Draft
Datawav wants to merge 1 commit into
Draft
Conversation
Datawav
force-pushed
the
datawav/airplane-mode-authentication
branch
from
September 1, 2026 10:29
2d2a6d3 to
16e4359
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs GrapheneOS/os-issue-tracker#6059
This proof of concept adds an opt-in, off-by-default global setting used by SystemUI to require fresh system authentication before user-initiated airplane mode disablement.
The prompt uses the active user's standard operating-system authentication configuration: a strong biometric or the existing device credential (PIN, pattern, or password). It does not create or store a separate password. Enabling airplane mode remains immediate.
SystemUI coverage includes:
The authentication interactor is a SystemUI singleton, so a second disable request cannot open another prompt. Cancellation, authentication error, or lockout leaves airplane mode enabled. Each callback rechecks live airplane-mode state before writing. The legacy tile and Internet dialog retain ownership of their prompt and cancel it when their UI lifecycle ends. The prompt and security check use
UserTracker.userContext, so secondary users authenticate against their own configured credential.The protected setting is also included in SettingsProvider's global-settings proto dump.
This is deliberately UI-level accidental-activation protection rather than a central radio policy. Shell and privileged API callers, emergency behavior, watch synchronization, and the airplane action that is not present in GrapheneOS's configured global-actions list are outside this proof of concept.
Paired with GrapheneOS/platform_packages_apps_Settings#445, which exposes the option and protects the Settings airplane-mode toggle.
Test: not run; building GrapheneOS was intentionally not attempted on the resource-constrained development host.
git diff --checkpassed, modified XML parsed successfully, the complete cross-repository diff received Sol static review, and an independent immutable-diff Claude Opus review passed before publication. Suggested upstream targets are the affectedSystemUITestsand SystemUI multivalent test classes added or updated by this change.