Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Add SDK sandbox UIDs to network policy." into tm-dev

Browse Source
This commit is contained in:
Martijn Coenen
2022-03-17 13:37:00 +00:00
committed by Android (Google) Code Review
parent 8e98ddc6b0 f38bbca78e
commit 717f0992f1
1 changed files with 47 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
services/core/java/com/android/server/net/NetworkPolicyManagerService.java
View File

@@ -5421,6 +5421,11 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
try {
mNetworkManager.setUidOnMeteredNetworkDenylist(uid, enable);
mLogger.meteredAllowlistChanged(uid, enable);
if (Process.isApplicationUid(uid)) {
final int sdkSandboxUid = Process.toSdkSandboxUid(uid);
mNetworkManager.setUidOnMeteredNetworkDenylist(sdkSandboxUid, enable);
mLogger.meteredAllowlistChanged(sdkSandboxUid, enable);
}
} catch (IllegalStateException e) {
Log.wtf(TAG, "problem setting denylist (" + enable + ") rules for " + uid, e);
} catch (RemoteException e) {
@@ -5433,6 +5438,11 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
try {
mNetworkManager.setUidOnMeteredNetworkAllowlist(uid, enable);
mLogger.meteredDenylistChanged(uid, enable);
if (Process.isApplicationUid(uid)) {
final int sdkSandboxUid = Process.toSdkSandboxUid(uid);
mNetworkManager.setUidOnMeteredNetworkAllowlist(sdkSandboxUid, enable);
mLogger.meteredDenylistChanged(sdkSandboxUid, enable);
}
} catch (IllegalStateException e) {
Log.wtf(TAG, "problem setting allowlist (" + enable + ") rules for " + uid, e);
} catch (RemoteException e) {
@@ -5471,12 +5481,31 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
}
}
private void addSdkSandboxUidsIfNeeded(SparseIntArray uidRules) {
final int size = uidRules.size();
final SparseIntArray sdkSandboxUids = new SparseIntArray();
for (int index = 0; index < size; index++) {
final int uid = uidRules.keyAt(index);
final int rule = uidRules.valueAt(index);
if (Process.isApplicationUid(uid)) {
sdkSandboxUids.put(Process.toSdkSandboxUid(uid), rule);
}
}
for (int index = 0; index < sdkSandboxUids.size(); index++) {
final int uid = sdkSandboxUids.keyAt(index);
final int rule = sdkSandboxUids.valueAt(index);
uidRules.put(uid, rule);
}
}
/**
* Set uid rules on a particular firewall chain. This is going to synchronize the rules given
* here to netd. It will clean up dead rules and make sure the target chain only contains rules
* specified here.
*/
private void setUidFirewallRulesUL(int chain, SparseIntArray uidRules) {
addSdkSandboxUidsIfNeeded(uidRules);
try {
int size = uidRules.size();
int[] uids = new int[size];
@@ -5519,6 +5548,11 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
try {
mNetworkManager.setFirewallUidRule(chain, uid, rule);
mLogger.uidFirewallRuleChanged(chain, uid, rule);
if (Process.isApplicationUid(uid)) {
final int sdkSandboxUid = Process.toSdkSandboxUid(uid);
mNetworkManager.setFirewallUidRule(chain, sdkSandboxUid, rule);
mLogger.uidFirewallRuleChanged(chain, sdkSandboxUid, rule);
}
} catch (IllegalStateException e) {
Log.wtf(TAG, "problem setting firewall uid rules", e);
} catch (RemoteException e) {
@@ -5555,15 +5589,16 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
*/
private void resetUidFirewallRules(int uid) {
try {
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_DOZABLE, uid, FIREWALL_RULE_DEFAULT);
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_STANDBY, uid, FIREWALL_RULE_DEFAULT);
mNetworkManager
.setFirewallUidRule(FIREWALL_CHAIN_POWERSAVE, uid, FIREWALL_RULE_DEFAULT);
mNetworkManager
.setFirewallUidRule(FIREWALL_CHAIN_RESTRICTED, uid, FIREWALL_RULE_DEFAULT);
mNetworkManager
.setFirewallUidRule(FIREWALL_CHAIN_LOW_POWER_STANDBY, uid,
FIREWALL_RULE_DEFAULT);
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_DOZABLE, uid,
FIREWALL_RULE_DEFAULT);
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_STANDBY, uid,
FIREWALL_RULE_DEFAULT);
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_POWERSAVE, uid,
FIREWALL_RULE_DEFAULT);
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_RESTRICTED, uid,
FIREWALL_RULE_DEFAULT);
mNetworkManager.setFirewallUidRule(FIREWALL_CHAIN_LOW_POWER_STANDBY, uid,
FIREWALL_RULE_DEFAULT);
mNetworkManager.setUidOnMeteredNetworkAllowlist(uid, false);
mLogger.meteredAllowlistChanged(uid, false);
mNetworkManager.setUidOnMeteredNetworkDenylist(uid, false);
@@ -5573,6 +5608,9 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
} catch (RemoteException e) {
// ignored; service lives in system_server
}
if (Process.isApplicationUid(uid)) {
resetUidFirewallRules(Process.toSdkSandboxUid(uid));
}
}
@Deprecated