Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge changes from topic "restricted-mode-cts"

Browse Source 
* changes:
  Prevent clearing Restricted Mode uid state when other rules change
  Add shell command to query Restricted Mode state
  Add Restricted Mode settings observer to NetworkPolicyManagerService
This commit is contained in:
Patrick Rohr
2021-01-12 17:41:19 +00:00
committed by Gerrit Code Review
parent 1ab1849ab2 8591180dc5
commit a96eeac8d6
2 changed files with 85 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

109
services/core/java/com/android/server/net/NetworkPolicyManagerService.java
View File

@@ -149,6 +149,7 @@ import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.UserInfo;
import android.content.res.Resources;
import android.database.ContentObserver;
import android.net.ConnectivityManager;
import android.net.ConnectivityManager.NetworkCallback;
import android.net.IConnectivityManager;
@@ -609,6 +610,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
@GuardedBy("mUidRulesFirstLock")
private final SparseBooleanArray mInternetPermissionMap = new SparseBooleanArray();
private RestrictedModeObserver mRestrictedModeObserver;
// TODO: keep allowlist of system-critical services that should never have
// rules enforced, such as system, phone, and radio UIDs.
@@ -622,7 +625,35 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
int COUNT = IS_UID_NETWORKING_BLOCKED + 1;
}
public final StatLogger mStatLogger = new StatLogger(new String[] {
private static class RestrictedModeObserver extends ContentObserver {
private final Context mContext;
private final RestrictedModeListener mListener;
RestrictedModeObserver(Context ctx, RestrictedModeListener listener) {
super(null);
mContext = ctx;
mListener = listener;
mContext.getContentResolver().registerContentObserver(
Settings.Global.getUriFor(Settings.Global.RESTRICTED_NETWORKING_MODE), false,
this);
}
public boolean isRestrictedModeEnabled() {
return Settings.Global.getInt(mContext.getContentResolver(),
Settings.Global.RESTRICTED_NETWORKING_MODE, 0) != 0;
}
@Override
public void onChange(boolean selfChange) {
mListener.onChange(isRestrictedModeEnabled());
}
public interface RestrictedModeListener {
void onChange(boolean enabled);
}
}
public final StatLogger mStatLogger = new StatLogger(new String[]{
"updateNetworkEnabledNL()",
"isUidNetworkingBlocked()",
});
@@ -797,9 +828,14 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
mRestrictPower = mPowerManagerInternal.getLowPowerState(
ServiceType.NETWORK_FIREWALL).batterySaverEnabled;
mRestrictedNetworkingMode = Settings.Global.getInt(
mContext.getContentResolver(),
Settings.Global.RESTRICTED_NETWORKING_MODE, 0) != 0;
mRestrictedModeObserver = new RestrictedModeObserver(mContext,
enabled -> {
synchronized (mUidRulesFirstLock) {
mRestrictedNetworkingMode = enabled;
updateRestrictedModeAllowlistUL();
}
});
mRestrictedNetworkingMode = mRestrictedModeObserver.isRestrictedModeEnabled();
mSystemReady = true;
@@ -3828,6 +3864,13 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
}
}
@VisibleForTesting
boolean isRestrictedModeEnabled() {
synchronized (mUidRulesFirstLock) {
return mRestrictedNetworkingMode;
}
}
/**
* updates restricted mode state / access for all apps
* Called on initialization and when restricted mode is enabled / disabled.
@@ -4455,26 +4498,26 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
final boolean isDenied = (uidPolicy & POLICY_REJECT_METERED_BACKGROUND) != 0;
final boolean isAllowed = (uidPolicy & POLICY_ALLOW_METERED_BACKGROUND) != 0;
final int oldRule = oldUidRules & MASK_METERED_NETWORKS;
int newRule = RULE_NONE;
// copy oldUidRules and clear out METERED_NETWORKS rules.
int newUidRules = oldUidRules & (~MASK_METERED_NETWORKS);
// First step: define the new rule based on user restrictions and foreground state.
if (isRestrictedByAdmin) {
newRule = RULE_REJECT_METERED;
newUidRules |= RULE_REJECT_METERED;
} else if (isForeground) {
if (isDenied || (mRestrictBackground && !isAllowed)) {
newRule = RULE_TEMPORARY_ALLOW_METERED;
newUidRules |= RULE_TEMPORARY_ALLOW_METERED;
} else if (isAllowed) {
newRule = RULE_ALLOW_METERED;
newUidRules |= RULE_ALLOW_METERED;
}
} else {
if (isDenied) {
newRule = RULE_REJECT_METERED;
newUidRules |= RULE_REJECT_METERED;
} else if (mRestrictBackground && isAllowed) {
newRule = RULE_ALLOW_METERED;
newUidRules |= RULE_ALLOW_METERED;
}
}
final int newUidRules = newRule | (oldUidRules & MASK_ALL_NETWORKS);
if (LOGV) {
Log.v(TAG, "updateRuleForRestrictBackgroundUL(" + uid + ")"
@@ -4482,8 +4525,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
+ ", isDenied=" + isDenied
+ ", isAllowed=" + isAllowed
+ ", isRestrictedByAdmin=" + isRestrictedByAdmin
+ ", oldRule=" + uidRulesToString(oldRule)
+ ", newRule=" + uidRulesToString(newRule)
+ ", oldRule=" + uidRulesToString(oldUidRules & MASK_METERED_NETWORKS)
+ ", newRule=" + uidRulesToString(newUidRules & MASK_METERED_NETWORKS)
+ ", newUidRules=" + uidRulesToString(newUidRules)
+ ", oldUidRules=" + uidRulesToString(oldUidRules));
}
@@ -4495,8 +4538,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
}
// Second step: apply bw changes based on change of state.
if (newRule != oldRule) {
if (hasRule(newRule, RULE_TEMPORARY_ALLOW_METERED)) {
if (newUidRules != oldUidRules) {
if (hasRule(newUidRules, RULE_TEMPORARY_ALLOW_METERED)) {
// Temporarily allow foreground app, removing from denylist if necessary
// (since bw_penalty_box prevails over bw_happy_box).
@@ -4507,7 +4550,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
if (isDenied) {
setMeteredNetworkDenylist(uid, false);
}
} else if (hasRule(oldRule, RULE_TEMPORARY_ALLOW_METERED)) {
} else if (hasRule(oldUidRules, RULE_TEMPORARY_ALLOW_METERED)) {
// Remove temporary exemption from app that is not on foreground anymore.
// TODO: if statements below are used to avoid unnecessary calls to netd / iptables,
@@ -4520,18 +4563,18 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
if (isDenied || isRestrictedByAdmin) {
setMeteredNetworkDenylist(uid, true);
}
} else if (hasRule(newRule, RULE_REJECT_METERED)
|| hasRule(oldRule, RULE_REJECT_METERED)) {
} else if (hasRule(newUidRules, RULE_REJECT_METERED)
|| hasRule(oldUidRules, RULE_REJECT_METERED)) {
// Flip state because app was explicitly added or removed to denylist.
setMeteredNetworkDenylist(uid, (isDenied || isRestrictedByAdmin));
if (hasRule(oldRule, RULE_REJECT_METERED) && isAllowed) {
if (hasRule(oldUidRules, RULE_REJECT_METERED) && isAllowed) {
// Since denial prevails over allowance, we need to handle the special case
// where app is allowed and denied at the same time (although such
// scenario should be blocked by the UI), then it is removed from the denylist.
setMeteredNetworkAllowlist(uid, isAllowed);
}
} else if (hasRule(newRule, RULE_ALLOW_METERED)
|| hasRule(oldRule, RULE_ALLOW_METERED)) {
} else if (hasRule(newUidRules, RULE_ALLOW_METERED)
|| hasRule(oldUidRules, RULE_ALLOW_METERED)) {
// Flip state because app was explicitly added or removed to allowlist.
setMeteredNetworkAllowlist(uid, isAllowed);
} else {
@@ -4617,8 +4660,9 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
final boolean isForeground = isUidForegroundOnRestrictPowerUL(uid);
final boolean isWhitelisted = isWhitelistedFromPowerSaveUL(uid, mDeviceIdleMode);
final int oldRule = oldUidRules & MASK_ALL_NETWORKS;
int newRule = RULE_NONE;
// Copy existing uid rules and clear ALL_NETWORK rules.
int newUidRules = oldUidRules & (~MASK_ALL_NETWORKS);
// First step: define the new rule based on user restrictions and foreground state.
@@ -4626,14 +4670,12 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
// by considering the foreground and non-foreground states.
if (isForeground) {
if (restrictMode) {
newRule = RULE_ALLOW_ALL;
newUidRules |= RULE_ALLOW_ALL;
}
} else if (restrictMode) {
newRule = isWhitelisted ? RULE_ALLOW_ALL : RULE_REJECT_ALL;
newUidRules |= isWhitelisted ? RULE_ALLOW_ALL : RULE_REJECT_ALL;
}
final int newUidRules = (oldUidRules & MASK_METERED_NETWORKS) | newRule;
if (LOGV) {
Log.v(TAG, "updateRulesForPowerRestrictionsUL(" + uid + ")"
+ ", isIdle: " + isUidIdle
@@ -4641,17 +4683,18 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub {
+ ", mDeviceIdleMode: " + mDeviceIdleMode
+ ", isForeground=" + isForeground
+ ", isWhitelisted=" + isWhitelisted
+ ", oldRule=" + uidRulesToString(oldRule)
+ ", newRule=" + uidRulesToString(newRule)
+ ", oldRule=" + uidRulesToString(oldUidRules & MASK_ALL_NETWORKS)
+ ", newRule=" + uidRulesToString(newUidRules & MASK_ALL_NETWORKS)
+ ", newUidRules=" + uidRulesToString(newUidRules)
+ ", oldUidRules=" + uidRulesToString(oldUidRules));
}
// Second step: notify listeners if state changed.
if (newRule != oldRule) {
if (newRule == RULE_NONE || hasRule(newRule, RULE_ALLOW_ALL)) {
if (newUidRules != oldUidRules) {
if ((newUidRules & MASK_ALL_NETWORKS) == RULE_NONE || hasRule(newUidRules,
RULE_ALLOW_ALL)) {
if (LOGV) Log.v(TAG, "Allowing non-metered access for UID " + uid);
} else if (hasRule(newRule, RULE_REJECT_ALL)) {
} else if (hasRule(newUidRules, RULE_REJECT_ALL)) {
if (LOGV) Log.v(TAG, "Rejecting non-metered access for UID " + uid);
} else {
// All scenarios should have been covered above

9
services/core/java/com/android/server/net/NetworkPolicyManagerShellCommand.java
View File

@@ -119,6 +119,8 @@ class NetworkPolicyManagerShellCommand extends ShellCommand {
switch(type) {
case "restrict-background":
return getRestrictBackground();
case "restricted-mode":
return getRestrictedModeState();
}
pw.println("Error: unknown get type '" + type + "'");
return -1;
@@ -255,6 +257,13 @@ class NetworkPolicyManagerShellCommand extends ShellCommand {
return listUidList("App Idle whitelisted UIDs", uids);
}
private int getRestrictedModeState() {
final PrintWriter pw = getOutPrintWriter();
pw.print("Restricted mode status: ");
pw.println(mInterface.isRestrictedModeEnabled() ? "enabled" : "disabled");
return 0;
}
private int getRestrictBackground() throws RemoteException {
final PrintWriter pw = getOutPrintWriter();
pw.print("Restrict background status: ");