diff --git a/common/flags.aconfig b/common/flags.aconfig index 5f279fa654..51b4fc009f 100644 --- a/common/flags.aconfig +++ b/common/flags.aconfig @@ -171,6 +171,6 @@ flag { is_exported: true namespace: "android_core_networking" description: "Flag for controlling access to the local network behind a new runtime permission. Requires ConnectivityCompatChanges.RESTRICT_LOCAL_NETWORK to enable feature." - bug: "365139289" + bug: "388774939" is_fixed_read_only: true } diff --git a/service/src/com/android/server/BpfNetMaps.java b/service/src/com/android/server/BpfNetMaps.java index c743573f45..4fae73a617 100644 --- a/service/src/com/android/server/BpfNetMaps.java +++ b/service/src/com/android/server/BpfNetMaps.java @@ -464,7 +464,7 @@ public class BpfNetMaps { ToDo : Remove this method when SdkLevel.isAtLeastB() is fixed, aosp is at sdk level 36 or use NetworkStackUtils.isAtLeast25Q2 when it is moved to a static lib. */ - private static boolean isAtLeast25Q2() { + public static boolean isAtLeast25Q2() { return SdkLevel.isAtLeastB() || (SdkLevel.isAtLeastV() && "Baklava".equals(Build.VERSION.CODENAME)); } diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java index 0d388e89f0..737e27ae16 100755 --- a/service/src/com/android/server/connectivity/PermissionMonitor.java +++ b/service/src/com/android/server/connectivity/PermissionMonitor.java @@ -282,7 +282,8 @@ public class PermissionMonitor { mContext = context; mBpfNetMaps = bpfNetMaps; mThread = thread; - if (Flags.restrictLocalNetwork()) { + if (BpfNetMaps.isAtLeast25Q2()) { + // Local net restrictions is supported as a developer opt-in starting in Android B. // This listener should finish registration by the time the system has completed // boot setup such that any changes to runtime permissions for local network // restrictions can only occur after this registration has completed. @@ -1330,7 +1331,8 @@ public class PermissionMonitor { // Flags.restrictLocalNetwork() is used to offer the feature to devices, but it will // only be enforced when develoeprs choose to enable it. // TODO(b/394567896): Update compat change checks - if (CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid)) { + if (CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid) + && BpfNetMaps.isAtLeast25Q2()) { // TODO(b/388803658): Update network permissions and record change } }