LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix the internet permission for native services

Browse Source 
The native services should specify their permissions in platform.xml if
they need internet permission, otherwise the eBPF program will block the
socket creation request. Fixing the known services that are in group
AID_INET but didn't specify their permission in the xml file.

Bug: 132217906
Test: CtsJdwpTestCases dumpsys netd trafficcontroller
Change-Id: I84cde7d3757953bc0bf761727d64a715bcdd68bb
This commit is contained in:
Chenbo Feng
2019-05-22 15:28:49 -07:00
parent 43c1536c6b
commit 99869f413a
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/connectivity/PermissionMonitor.java
View File

@@ -199,15 +199,13 @@ public class PermissionMonitor {
ArraySet<String> perms = systemPermission.valueAt(i);
int uid = systemPermission.keyAt(i);
int netdPermission = 0;
// Get the uids of native services that have UPDATE_DEVICE_STATS permission.
// Get the uids of native services that have UPDATE_DEVICE_STATS or INTERNET permission.
if (perms != null) {
netdPermission |= perms.contains(UPDATE_DEVICE_STATS)
? INetd.PERMISSION_UPDATE_DEVICE_STATS : 0;
netdPermission |= perms.contains(INTERNET)
? INetd.PERMISSION_INTERNET : 0;
}
// For internet permission, the native services have their own selinux domains and
// sepolicy will control the socket creation during run time. netd cannot block the
// socket creation based on the permission information here.
netdPermission |= INetd.PERMISSION_INTERNET;
netdPermsUids.put(uid, netdPermsUids.get(uid) | netdPermission);
}
log("Users: " + mUsers.size() + ", Apps: " + mApps.size());