From f0b4cd7fed121e07f0ae734cb98b428f256c65a9 Mon Sep 17 00:00:00 2001 From: paulhu Date: Thu, 24 Dec 2020 19:47:34 +0800 Subject: [PATCH] Replace NetworkPolicyManagerInternal#isUidRestrictedOnMeteredNetworks() Connectivity service is going to become a mainline module which will not able to access hidden APIs. NetworkPolicyManagerInternal is a internal serivce that CS can't be access after be a mainline module. Thus, create NPMS#isUidRestrictedOnMeteredNetworks() and NPM#isUidRestrictedOnMeteredNetworks() to replace NPMI#isUidRestrictedOnMeteredNetworks(). Also correct the permission check in isUidNetworkingBlocked() that needs to check OBSERVE_NETWORK_POLICY only. Bug: 170598012 Test: atest FrameworksNetTests Test: atest FrameworksCoreTests:NetworkPolicyManagerTest Test: atest FrameworksServicesTests:NetworkPolicyManagerServiceTest Test: atest CtsNetTestCases Test: atest CtsHostsideNetworkTests Change-Id: I5801a3a2076f3eb199a0226c38c85014b26c64e7 --- .../android/net/INetworkPolicyManager.aidl | 1 + .../android/net/NetworkPolicyManager.java | 16 +++++++++ .../android/server/ConnectivityService.java | 11 ++++-- .../net/NetworkPolicyManagerInternal.java | 5 --- .../net/NetworkPolicyManagerService.java | 35 ++++++++++--------- 5 files changed, 43 insertions(+), 25 deletions(-) diff --git a/core/java/android/net/INetworkPolicyManager.aidl b/core/java/android/net/INetworkPolicyManager.aidl index 792e5b410afcc..29a3fdf59e8ba 100644 --- a/core/java/android/net/INetworkPolicyManager.aidl +++ b/core/java/android/net/INetworkPolicyManager.aidl @@ -81,4 +81,5 @@ interface INetworkPolicyManager { void factoryReset(String subscriber); boolean isUidNetworkingBlocked(int uid, boolean meteredNetwork); + boolean isUidRestrictedOnMeteredNetworks(int uid); } diff --git a/core/java/android/net/NetworkPolicyManager.java b/core/java/android/net/NetworkPolicyManager.java index c029deae09df6..82b035b084286 100644 --- a/core/java/android/net/NetworkPolicyManager.java +++ b/core/java/android/net/NetworkPolicyManager.java @@ -459,6 +459,22 @@ public class NetworkPolicyManager { } } + /** + * Check that the given uid is restricted from doing networking on metered networks. + * + * @param uid The target uid. + * @return true if the given uid is restricted from doing networking on metered networks. + * + * @hide + */ + public boolean isUidRestrictedOnMeteredNetworks(int uid) { + try { + return mService.isUidRestrictedOnMeteredNetworks(uid); + } catch (RemoteException e) { + throw e.rethrowFromSystemServer(); + } + } + /** * Get multipath preference for the given network. */ diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java index 7541833b15692..ba9982175c02b 100644 --- a/services/core/java/com/android/server/ConnectivityService.java +++ b/services/core/java/com/android/server/ConnectivityService.java @@ -5777,9 +5777,14 @@ public class ConnectivityService extends IConnectivityManager.Stub // Policy already enforced. return; } - if (mPolicyManagerInternal.isUidRestrictedOnMeteredNetworks(uid)) { - // If UID is restricted, don't allow them to bring up metered APNs. - networkCapabilities.addCapability(NET_CAPABILITY_NOT_METERED); + final long ident = Binder.clearCallingIdentity(); + try { + if (mPolicyManager.isUidRestrictedOnMeteredNetworks(uid)) { + // If UID is restricted, don't allow them to bring up metered APNs. + networkCapabilities.addCapability(NET_CAPABILITY_NOT_METERED); + } + } finally { + Binder.restoreCallingIdentity(ident); } } diff --git a/services/core/java/com/android/server/net/NetworkPolicyManagerInternal.java b/services/core/java/com/android/server/net/NetworkPolicyManagerInternal.java index 141fa6a178732..f92f3dcd77ef4 100644 --- a/services/core/java/com/android/server/net/NetworkPolicyManagerInternal.java +++ b/services/core/java/com/android/server/net/NetworkPolicyManagerInternal.java @@ -38,11 +38,6 @@ public abstract class NetworkPolicyManagerInternal { */ public abstract void resetUserState(int userId); - /** - * @return true if the given uid is restricted from doing networking on metered networks. - */ - public abstract boolean isUidRestrictedOnMeteredNetworks(int uid); - /** * Figure out if networking is blocked for a given set of conditions. * diff --git a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java index 1c41dc073ac8f..01d4faf5c5941 100644 --- a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java +++ b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java @@ -5361,7 +5361,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { public boolean isUidNetworkingBlocked(int uid, boolean isNetworkMetered) { final long startTime = mStatLogger.getTime(); - enforceAnyPermissionOf(OBSERVE_NETWORK_POLICY, PERMISSION_MAINLINE_NETWORK_STACK); + mContext.enforceCallingOrSelfPermission(OBSERVE_NETWORK_POLICY, TAG); final int uidRules; final boolean isBackgroundRestricted; synchronized (mUidRulesFirstLock) { @@ -5376,6 +5376,23 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { return ret; } + @Override + public boolean isUidRestrictedOnMeteredNetworks(int uid) { + mContext.enforceCallingOrSelfPermission(OBSERVE_NETWORK_POLICY, TAG); + final int uidRules; + final boolean isBackgroundRestricted; + synchronized (mUidRulesFirstLock) { + uidRules = mUidRules.get(uid, RULE_ALLOW_ALL); + isBackgroundRestricted = mRestrictBackground; + } + //TODO(b/177490332): The logic here might not be correct because it doesn't consider + // RULE_REJECT_METERED condition. And it could be replaced by + // isUidNetworkingBlockedInternal(). + return isBackgroundRestricted + && !hasRule(uidRules, RULE_ALLOW_METERED) + && !hasRule(uidRules, RULE_TEMPORARY_ALLOW_METERED); + } + private static boolean isSystem(int uid) { return uid < Process.FIRST_APPLICATION_UID; } @@ -5444,22 +5461,6 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { } } - /** - * @return true if the given uid is restricted from doing networking on metered networks. - */ - @Override - public boolean isUidRestrictedOnMeteredNetworks(int uid) { - final int uidRules; - final boolean isBackgroundRestricted; - synchronized (mUidRulesFirstLock) { - uidRules = mUidRules.get(uid, RULE_ALLOW_ALL); - isBackgroundRestricted = mRestrictBackground; - } - return isBackgroundRestricted - && !hasRule(uidRules, RULE_ALLOW_METERED) - && !hasRule(uidRules, RULE_TEMPORARY_ALLOW_METERED); - } - @Override public void onTempPowerSaveWhitelistChange(int appId, boolean added) { synchronized (mUidRulesFirstLock) {