[Nexus 5X General] OhioYJ:
Back in September 2017 Lineage made some changes to the privacy guard in attempts to clean it up. Unfortunately, this this sacrificed user privacy, and means you must go into the privacy guard multiple times. Until an app actually uses a feature it will not appear in the privacy guard unless it has been specifically declared. This also means by the time it appears in the privacy guard, it's already accessed your information. Second we all know how much fun setting up the privacy guard is after a clean install.

** This requires root access **

To fix this both of these issues, and give you access to options you didn't have before you can create a script. I do want to thank Gabriele for supplying the information to help with this.

The options you have available to set are:

COARSE_LOCATION

FINE_LOCATION

GPS

VIBRATE

READ_CONTACTS

WRITE_CONTACTS

READ_CALL_LOG

READ_CALENDAR

WRITE_CALENDAR

WIFI_SCAN

POST_NOTIFICATION

NEIGHBORING_CELLS

CALL_PHONE

READ_SMS

WRITE_SMS

RECEIVE_SMS

RECEIVE_EMERGECY_SMS

RECEIVE_MMS

RECEIVE_WAP_PUSH

SEND_SMS

READ_ICC_SMS

WRITE_ICC_SMS

WRITE_SETTINGS

SYSTEM_ALERT_WINDOW

ACCESS_NOTIFICATIONS

CAMERA

RECORD_AUDIO

PLAY_AUDIO

READ_CLIPBOARD

WRITE_CLIPBOARD

TAKE_MEDIA_BUTTONS

TAKE_AUDIO_FOCUS

AUDIO_MASTER_VOLUME

AUDIO_VOICE_VOLUME

AUDIO_RING_VOLUME

AUDIO_MEDIA_VOLUME

AUDIO_ALARM_VOLUME

AUDIO_NOTIFICATION_VOLUME

AUDIO_BLUETOOTH_VOLUME

WAKE_LOCK

MONITOR_LOCATION

MONITOR_HIGH_POWER_LOCATION

GET_USAGE_STATS

MUTE_MICROPHONE

TOAST_WINDOW

PROJECT_MEDIA

ACTIVATE_VPN

WRITE_WALLPAPER

ASSIST_STRUCTURE

ASSIST_SCREENSHOT

OP_READ_PHONE_STATE

ADD_VOICEMAIL

USE_SIP

PROCESS_OUTGOING_CALLS

USE_FINGERPRINT

BODY_SENSORS

READ_CELL_BROADCASTS

MOCK_LOCATION

READ_EXTERNAL_STORAGE

WRITE_EXTERNAL_STORAGE

TURN_ON_SCREEN

GET_ACCOUNTS

RUN_IN_BACKGROUND

WIFI_CHANGE

BLUETOOTH_CHANGE

BOOT_COMPLETED

NFC_CHANGE

DATA_CONNECT_CHANGE

SU

The first thing you need to do is enable to the local terminal app. This is under developer options, Local terminal.

This will place a terminal icon in your app drawer.

For all of these commands you need the actual program name. This piece of information is available in settings, under application information. In this example, it is com.adobe.reader.

To see what permissions an app has, in the terminal you need root permissions. So the first thing you need to do is type SU. If you never done this before grant the terminal root permissions. Then type:

appops get com.adobe.reader

Or whatever app you want. This should show you what permissions that particular application currently has.

Now onto the good stuff. Actually making a script, and adding in options to the privacy guard. Your script is just written in any basic text editor. However, make sure you save it with the ending .sh

It follows this template:

appops set <PACKAGE> COARSE_LOCATION <MODE>

appops set <PACKAGE> FINE_LOCATION <MODE>

appops set <PACKAGE> GPS <MODE>

appops set <PACKAGE> VIBRATE <MODE>

appops set <PACKAGE> READ_CONTACTS <MODE>

appops set <PACKAGE> WRITE_CONTACTS <MODE>

appops set <PACKAGE> READ_CALL_LOG <MODE>

appops set <PACKAGE> READ_CALENDAR <MODE>

appops set <PACKAGE> WRITE_CALENDAR <MODE>

appops set <PACKAGE> WIFI_SCAN <MODE>

appops set <PACKAGE> POST_NOTIFICATION <MODE>

appops set <PACKAGE> NEIGHBORING_CELLS <MODE>

appops set <PACKAGE> CALL_PHONE <MODE>

appops set <PACKAGE> READ_SMS <MODE>

appops set <PACKAGE> WRITE_SMS <MODE>

appops set <PACKAGE> RECEIVE_SMS <MODE>

appops set <PACKAGE> RECEIVE_EMERGECY_SMS <MODE>

appops set <PACKAGE> RECEIVE_MMS <MODE>

appops set <PACKAGE> RECEIVE_WAP_PUSH <MODE>

appops set <PACKAGE> SEND_SMS <MODE>

appops set <PACKAGE> READ_ICC_SMS <MODE>

appops set <PACKAGE> WRITE_ICC_SMS <MODE>

appops set <PACKAGE> WRITE_SETTINGS <MODE>

appops set <PACKAGE> SYSTEM_ALERT_WINDOW <MODE>

appops set <PACKAGE> ACCESS_NOTIFICATIONS <MODE>

appops set <PACKAGE> CAMERA <MODE>

appops set <PACKAGE> RECORD_AUDIO <MODE>

appops set <PACKAGE> PLAY_AUDIO <MODE>

appops set <PACKAGE> READ_CLIPBOARD <MODE>

appops set <PACKAGE> WRITE_CLIPBOARD <MODE>

appops set <PACKAGE> TAKE_MEDIA_BUTTONS <MODE>

appops set <PACKAGE> TAKE_AUDIO_FOCUS <MODE>

appops set <PACKAGE> AUDIO_MASTER_VOLUME <MODE>

appops set <PACKAGE> AUDIO_VOICE_VOLUME <MODE>

appops set <PACKAGE> AUDIO_RING_VOLUME <MODE>

appops set <PACKAGE> AUDIO_MEDIA_VOLUME <MODE>

appops set <PACKAGE> AUDIO_ALARM_VOLUME <MODE>

appops set <PACKAGE> AUDIO_NOTIFICATION_VOLUME <MODE>

appops set <PACKAGE> AUDIO_BLUETOOTH_VOLUME <MODE>

appops set <PACKAGE> WAKE_LOCK <MODE>

appops set <PACKAGE> MONITOR_LOCATION <MODE>

appops set <PACKAGE> MONITOR_HIGH_POWER_LOCATION <MODE>

appops set <PACKAGE> GET_USAGE_STATS <MODE>

appops set <PACKAGE> MUTE_MICROPHONE <MODE>

appops set <PACKAGE> TOAST_WINDOW <MODE>

appops set <PACKAGE> PROJECT_MEDIA <MODE>

appops set <PACKAGE> ACTIVATE_VPN <MODE>

appops set <PACKAGE> WRITE_WALLPAPER <MODE>

appops set <PACKAGE> ASSIST_STRUCTURE <MODE>

appops set <PACKAGE> ASSIST_SCREENSHOT <MODE>

appops set <PACKAGE> OP_READ_PHONE_STATE <MODE>

appops set <PACKAGE> ADD_VOICEMAIL <MODE>

appops set <PACKAGE> USE_SIP <MODE>

appops set <PACKAGE> PROCESS_OUTGOING_CALLS <MODE>

appops set <PACKAGE> USE_FINGERPRINT <MODE>

appops set <PACKAGE> BODY_SENSORS <MODE>

appops set <PACKAGE> READ_CELL_BROADCASTS <MODE>

appops set <PACKAGE> MOCK_LOCATION <MODE>

appops set <PACKAGE> READ_EXTERNAL_STORAGE <MODE>

appops set <PACKAGE> WRITE_EXTERNAL_STORAGE <MODE>

appops set <PACKAGE> TURN_ON_SCREEN <MODE>

appops set <PACKAGE> GET_ACCOUNTS <MODE>

appops set <PACKAGE> RUN_IN_BACKGROUND <MODE>

appops set <PACKAGE> WIFI_CHANGE <MODE>

appops set <PACKAGE> BLUETOOTH_CHANGE <MODE>

appops set <PACKAGE> BOOT_COMPLETED <MODE>

appops set <PACKAGE> NFC_CHANGE <MODE>

appops set <PACKAGE> DATA_CONNECT_CHANGE <MODE>

appops set <PACKAGE> SU <MODE>

< PACKAGE > Gets replaced with the program name. < MODE > Gets replaced with ignore, allow, or ask. The " # " is a comment. So here is an example from my script file:

#Gello Browser

appops set org.cyanogenmod.gello.browser COARSE_LOCATION ignore

appops set org.cyanogenmod.gello.browser FINE_LOCATION ignore

appops set org.cyanogenmod.gello.browser GPS ignore

appops set org.cyanogenmod.gello.browser VIBRATE ignore

appops set org.cyanogenmod.gello.browser READ_CONTACTS ignore

appops set org.cyanogenmod.gello.browser WRITE_CONTACTS ignore

appops set org.cyanogenmod.gello.browser READ_CALL_LOG ignore

appops set org.cyanogenmod.gello.browser READ_CALENDAR ignore

appops set org.cyanogenmod.gello.browser WRITE_CALENDAR ignore

appops set org.cyanogenmod.gello.browser WIFI_SCAN ignore

appops set org.cyanogenmod.gello.browser POST_NOTIFICATION allow

appops set org.cyanogenmod.gello.browser NEIGHBORING_CELLS ignore

appops set org.cyanogenmod.gello.browser CALL_PHONE ignore

appops set org.cyanogenmod.gello.browser READ_SMS ignore

appops set org.cyanogenmod.gello.browser WRITE_SMS ignore

appops set org.cyanogenmod.gello.browser RECEIVE_SMS ignore

appops set org.cyanogenmod.gello.browser RECEIVE_EMERGECY_SMS ignore

appops set org.cyanogenmod.gello.browser RECEIVE_MMS ignore

appops set org.cyanogenmod.gello.browser RECEIVE_WAP_PUSH ignore

appops set org.cyanogenmod.gello.browser SEND_SMS ignore

appops set org.cyanogenmod.gello.browser READ_ICC_SMS ignore

appops set org.cyanogenmod.gello.browser WRITE_ICC_SMS ignore

appops set org.cyanogenmod.gello.browser WRITE_SETTINGS ignore

appops set org.cyanogenmod.gello.browser SYSTEM_ALERT_WINDOW ignore

appops set org.cyanogenmod.gello.browser ACCESS_NOTIFICATIONS allow

appops set org.cyanogenmod.gello.browser CAMERA ignore

appops set org.cyanogenmod.gello.browser RECORD_AUDIO ignore

appops set org.cyanogenmod.gello.browser PLAY_AUDIO allow

appops set org.cyanogenmod.gello.browser READ_CLIPBOARD allow

appops set org.cyanogenmod.gello.browser WRITE_CLIPBOARD allow

appops set org.cyanogenmod.gello.browser TAKE_MEDIA_BUTTONS ignore

appops set org.cyanogenmod.gello.browser TAKE_AUDIO_FOCUS ignore

appops set org.cyanogenmod.gello.browser AUDIO_MASTER_VOLUME allow

appops set org.cyanogenmod.gello.browser AUDIO_VOICE_VOLUME ask

appops set org.cyanogenmod.gello.browser AUDIO_RING_VOLUME ignore

appops set org.cyanogenmod.gello.browser AUDIO_MEDIA_VOLUME ignore

appops set org.cyanogenmod.gello.browser AUDIO_ALARM_VOLUME ignore

appops set org.cyanogenmod.gello.browser AUDIO_NOTIFICATION_VOLUME ask

appops set org.cyanogenmod.gello.browser AUDIO_BLUETOOTH_VOLUME ask

appops set org.cyanogenmod.gello.browser WAKE_LOCK allow

appops set org.cyanogenmod.gello.browser MONITOR_LOCATION ignore

appops set org.cyanogenmod.gello.browser MONITOR_HIGH_POWER_LOCATION ignore

appops set org.cyanogenmod.gello.browser GET_USAGE_STATS ignore

appops set org.cyanogenmod.gello.browser MUTE_MICROPHONE ignore

appops set org.cyanogenmod.gello.browser TOAST_WINDOW allow

appops set org.cyanogenmod.gello.browser PROJECT_MEDIA ignore

appops set org.cyanogenmod.gello.browser ACTIVATE_VPN allow

appops set org.cyanogenmod.gello.browser WRITE_WALLPAPER ignore

appops set org.cyanogenmod.gello.browser ASSIST_STRUCTURE ignore

appops set org.cyanogenmod.gello.browser ASSIST_SCREENSHOT ask

appops set org.cyanogenmod.gello.browser OP_READ_PHONE_STATE ignore

appops set org.cyanogenmod.gello.browser ADD_VOICEMAIL ignore

appops set org.cyanogenmod.gello.browser USE_SIP ignore

appops set org.cyanogenmod.gello.browser PROCESS_OUTGOING_CALLS ignore

appops set org.cyanogenmod.gello.browser USE_FINGERPRINT ignore

appops set org.cyanogenmod.gello.browser BODY_SENSORS ignore

appops set org.cyanogenmod.gello.browser READ_CELL_BROADCASTS ignore

appops set org.cyanogenmod.gello.browser MOCK_LOCATION ignore

appops set org.cyanogenmod.gello.browser READ_EXTERNAL_STORAGE allow

appops set org.cyanogenmod.gello.browser WRITE_EXTERNAL_STORAGE allow

appops set org.cyanogenmod.gello.browser TURN_ON_SCREEN ignore

appops set org.cyanogenmod.gello.browser GET_ACCOUNTS ignore

appops set org.cyanogenmod.gello.browser RUN_IN_BACKGROUND allow

appops set org.cyanogenmod.gello.browser WIFI_CHANGE ignore

appops set org.cyanogenmod.gello.browser BLUETOOTH_CHANGE ignore

appops set org.cyanogenmod.gello.browser BOOT_COMPLETED ignore

appops set org.cyanogenmod.gello.browser NFC_CHANGE ignore

appops set org.cyanogenmod.gello.browser DATA_CONNECT_CHANGE ignore

appops set org.cyanogenmod.gello.browser SU ignore

The last line of your script should be:

appops write-settings

Now realize you don't have to use all those options up there. That is every option available. Not every app will use them. I've have not had any errors from setting options from apps that don't exists, so I've chosen to create one script for all my devices.

Once you get done with the script, use the terminal to run it:

So for those that aren't familiar with the terminal, the firs thing that you need to do is gain root privileges, by typing, su (as above). The "ls" command will list everything in the current directory, so you can figure out where you are. For simplicity sake, I just placed the script in the root directory of the internal memory. Note this directory is called sdcard, even though your device may not be using an actual SDCard. CD sdcard should look familiar to the windows users, this is just switching directories, to the sdcard folder, which again is actually internal memory on most devices. Finally, sh scriptname.sh will run the script.

Give it time, when you run the script it's not complete until the terminal goes to the next line. Mine took almost a minute. The biggest thing I noticed is you then have to go back to the privacy guard and re-enable it for every app, as it will be disabled. However all the options will now be what you chose. I don't know why it turns it off, but turn it back on is easier than manually changing all the settings.

You'll also notice now you have all sorts of new options in privacy guard for all the apps. Again though, most of these options won't ever be used by many of these apps.

For convenience I've attached an example file to this post. You will have to change the .txt extension to .sh, however it hopefully will give you an idea of what you can do with this.