Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 317336de authored by Chenbo Feng's avatar Chenbo Feng Committed by Alistair Strachan
Browse files

ANDROID: Remove Android paranoid check for socket creation 



For 4.14+ kernels, eBPF cgroup socket filter is used to control socket
creation on devices. Remove this check since it is no longer useful.

Signed-off-by: default avatarChenbo Feng <fengc@google.com>
Bug: 128944261
Test: CtsNetTestCasesInternetPermission
Change-Id: I2f353663389fc0f992e5a1b424c12215a2b074b0
parent e91d6a2a

net/ipv4/af_inet.c

+0 −17
Original line number Diff line number Diff line
@@ -121,20 +121,6 @@ 
#endif

#include <net/l3mdev.h>



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

#include <linux/android_aid.h>



static inline int current_has_network(void)

{

	return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);

}

#else

static inline int current_has_network(void)

{

	return 1;

}

#endif



/* The inetsw table contains everything that inet_create needs to

 * build a new socket.

 */
@@ -268,9 +254,6 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, 
	if (protocol < 0 || protocol >= IPPROTO_MAX)

		return -EINVAL;



	if (!current_has_network())

		return -EACCES;



	sock->state = SS_UNCONNECTED;



	/* Look for the requested type/protocol pair. */

net/ipv6/af_inet6.c

+0 −17
Original line number Diff line number Diff line
@@ -66,20 +66,6 @@ 
#include <linux/uaccess.h>

#include <linux/mroute6.h>



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

#include <linux/android_aid.h>



static inline int current_has_network(void)

{

	return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);

}

#else

static inline int current_has_network(void)

{

	return 1;

}

#endif



#include "ip6_offload.h"



MODULE_AUTHOR("Cast of dozens");
@@ -136,9 +122,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, 
	if (protocol < 0 || protocol >= IPPROTO_MAX)

		return -EINVAL;



	if (!current_has_network())

		return -EACCES;



	/* Look for the requested type/protocol pair. */

lookup_protocol:

	err = -ESOCKTNOSUPPORT;