joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge "Set restrict local network aconfig flag for 26q2 dates" into main

Browse source
This commit is contained in:
Jacque Li 2025-02-13 08:54:10 -08:00 • committed by Gerrit Code Review
commit e76f0d8233
3 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
common/flags.aconfig
View file

@ -171,6 +171,6 @@ flag {
is_exported: true
namespace: "android_core_networking"
description: "Flag for controlling access to the local network behind a new runtime permission. Requires ConnectivityCompatChanges.RESTRICT_LOCAL_NETWORK to enable feature."
bug: "365139289"
bug: "388774939"
is_fixed_read_only: true
}

2
service/src/com/android/server/BpfNetMaps.java
View file

@ -464,7 +464,7 @@ public class BpfNetMaps {
ToDo : Remove this method when SdkLevel.isAtLeastB() is fixed, aosp is at sdk level 36 or use
NetworkStackUtils.isAtLeast25Q2 when it is moved to a static lib.
*/
private static boolean isAtLeast25Q2() {
public static boolean isAtLeast25Q2() {
return SdkLevel.isAtLeastB() || (SdkLevel.isAtLeastV()
&& "Baklava".equals(Build.VERSION.CODENAME));
}

6
service/src/com/android/server/connectivity/PermissionMonitor.java
View file

@ -282,7 +282,8 @@ public class PermissionMonitor {
mContext = context;
mBpfNetMaps = bpfNetMaps;
mThread = thread;
if (Flags.restrictLocalNetwork()) {
if (BpfNetMaps.isAtLeast25Q2()) {
// Local net restrictions is supported as a developer opt-in starting in Android B.
// This listener should finish registration by the time the system has completed
// boot setup such that any changes to runtime permissions for local network
// restrictions can only occur after this registration has completed.
@ -1330,7 +1331,8 @@ public class PermissionMonitor {
// Flags.restrictLocalNetwork() is used to offer the feature to devices, but it will
// only be enforced when develoeprs choose to enable it.
// TODO(b/394567896): Update compat change checks
if (CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid)) {
if (CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid)
&& BpfNetMaps.isAtLeast25Q2()) {
// TODO(b/388803658): Update network permissions and record change
}
}