Anyway to split apps sharing an UID? For a while, I had an exclamation mark instead of a signal status in the top bar, and some apps didn't realize they were connected to Internet when other worked perfectly.
Thanks to AFWall+ logs, I found the issue.
I need to allow access to an app called com.android.engineeringmode.

But this app is tied (in OnePlus 3) with some others, as you can see in this screenshot :


I'm OK to allow access to EngineerMode, but certainly not to all this bunch of apps (especially camera or fingerprints services).

After searching the web, I found that all theses apps are linked in /data/system/packages.xml using the sharedUid 1000. But it is said to never change the UID of an app when it's shared (I didn't really get why).

I'm using the stock ROM (OxygenOS 3.2.8) from OP3, but rooted (got Xposed an Xprivacy too), so it's Android 6.0.1.

Is there any chance I can allow Network access to EngineerMode only ?
I don't think it's possible to change this without recompiling the ROM. You can't change the UID of apps after they're installed because they won't be able to access their files any more, and because it will confuse the app permissions system.

Maybe there's some other way around the problem with Xposed, but I don't know about that. It might be possible for an Xposed module to detect the exact call the package is making (to distinguish it from the calls made by other packages in the same process), and mark it for AFWall to allow it. That way you wouldn't need to split up the apps at all.

An alternative might be to find where it's trying to send traffic to, and whitelist that address for that process. Again, this would solve the specific symptom without splitting the apps. If it's the captive portal detection, it's probably http://client.android.com/generate_204.