joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Make firewall bpf code multi-user aware

Browse source 
The check is_system_uid should mirror the definition of core_uids in
UserHandle.isCore until it is available to be read from mainline code.
isUidNetworkingBlocked should also do the same.

Test: All existing tests should pass.
Test: atest CtsHostsideNetworkPolicyTests
Test: atest FrameworksNetTests

Bug: 348316140
Change-Id: Id5e01289b301a725b162ef249062e0f2806876dc
This commit is contained in:
Suprabh Shukla 2024-06-20 17:07:13 -07:00
commit 3d00262fe7
1 changed files with 33 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
framework/src/android/net/BpfNetMapsUtils.java
View file

@ -68,6 +68,7 @@ import static android.system.OsConstants.EINVAL;
import android.os.Build;
import android.os.Process;
import android.os.ServiceSpecificException;
import android.os.UserHandle;
import android.system.ErrnoException;
import android.system.Os;
import android.util.Pair;
@ -330,9 +331,9 @@ public class BpfNetMapsUtils {
) {
throwIfPreT("isUidBlockedByFirewallChains is not available on pre-T devices");
// System uid is not blocked by firewall chains, see bpf_progs/netd.c
// TODO: use UserHandle.isCore() once it is accessible
if (uid < Process.FIRST_APPLICATION_UID) {
// System uids are not blocked by firewall chains, see bpf_progs/netd.c
// TODO: b/348513058 - use UserHandle.isCore() once it is accessible
if (UserHandle.getAppId(uid) < Process.FIRST_APPLICATION_UID) {
return false;
}