Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6817cd5 authored by Chenbo Feng's avatar Chenbo Feng
Browse files

Clean up permissions when uids are no longer used 

The kernel eBPF maps have a blacklist to store all the uids that doesn't
have internet permission. When an app is unintalled from the device and
it is the last package on device that uses that uid, make sure we
cleaned the uid from the map and do not add no longer used uids into the
eBPF map. This action helps reduce the number of entries stored in the
map and reduce the chance of overflow the eBPF map.

Bug: 128944261
Test: PermissionMonitorTest
Change-Id: I10dd0113d00d6cf9ca39902d9721f2591d387d4a
parent 436fe58c

services/core/java/com/android/server/connectivity/PermissionMonitor.java

+12 −2
Original line number Diff line number Diff line
@@ -100,6 +100,9 @@ public class PermissionMonitor { 
                              app.requestedPermissionsFlags);

                    }

                }

            } else {

                // The last package of this uid is removed from device. Clean the package up.

                permission = INetd.PERMISSION_UNINSTALLED;

            }

            return permission;

        }
@@ -470,6 +473,7 @@ public class PermissionMonitor { 
        ArrayList<Integer> allPermissionAppIds = new ArrayList<>();

        ArrayList<Integer> internetPermissionAppIds = new ArrayList<>();

        ArrayList<Integer> updateStatsPermissionAppIds = new ArrayList<>();

        ArrayList<Integer> noPermissionAppIds = new ArrayList<>();

        ArrayList<Integer> uninstalledAppIds = new ArrayList<>();

        for (int i = 0; i < netdPermissionsAppIds.size(); i++) {

            int permissions = netdPermissionsAppIds.valueAt(i);
@@ -484,8 +488,10 @@ public class PermissionMonitor { 
                    updateStatsPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));

                    break;

                case INetd.NO_PERMISSIONS:

                    uninstalledAppIds.add(netdPermissionsAppIds.keyAt(i));

                    noPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));

                    break;

                case INetd.PERMISSION_UNINSTALLED:

                    uninstalledAppIds.add(netdPermissionsAppIds.keyAt(i));

                default:

                    Log.e(TAG, "unknown permission type: " + permissions + "for uid: "

                            + netdPermissionsAppIds.keyAt(i));
@@ -506,8 +512,12 @@ public class PermissionMonitor { 
                mNetd.trafficSetNetPermForUids(INetd.PERMISSION_UPDATE_DEVICE_STATS,

                        ArrayUtils.convertToIntArray(updateStatsPermissionAppIds));

            }

            if (uninstalledAppIds.size() != 0) {

            if (noPermissionAppIds.size() != 0) {

                mNetd.trafficSetNetPermForUids(INetd.NO_PERMISSIONS,

                        ArrayUtils.convertToIntArray(noPermissionAppIds));

            }

            if (uninstalledAppIds.size() != 0) {

                mNetd.trafficSetNetPermForUids(INetd.PERMISSION_UNINSTALLED,

                        ArrayUtils.convertToIntArray(uninstalledAppIds));

            }

        } catch (RemoteException e) {

tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java

+2 −2
Original line number Diff line number Diff line
@@ -501,7 +501,7 @@ public class PermissionMonitorTest { 


        when(mPackageManager.getPackagesForUid(MOCK_UID1)).thenReturn(new String[]{});

        mObserver.onPackageRemoved(MOCK_PACKAGE1, MOCK_UID1);

        mNetdServiceMonitor.expectPermission(INetd.NO_PERMISSIONS, new int[]{MOCK_UID1});

        mNetdServiceMonitor.expectPermission(INetd.PERMISSION_UNINSTALLED, new int[]{MOCK_UID1});

    }



    @Test
@@ -515,7 +515,7 @@ public class PermissionMonitorTest { 
        // Remove and install the same package to simulate the update action

        when(mPackageManager.getPackagesForUid(MOCK_UID1)).thenReturn(new String[]{});

        mObserver.onPackageRemoved(MOCK_PACKAGE1, MOCK_UID1);

        mNetdServiceMonitor.expectPermission(INetd.NO_PERMISSIONS, new int[]{MOCK_UID1});

        mNetdServiceMonitor.expectPermission(INetd.PERMISSION_UNINSTALLED, new int[]{MOCK_UID1});



        addPackage(MOCK_PACKAGE1, MOCK_UID1, new String[] {INTERNET});

        mNetdServiceMonitor.expectPermission(INetd.PERMISSION_INTERNET, new int[]{MOCK_UID1});