Merge "Support routing sockets as another user" (c3bdf875) · Commits · e / os / android_frameworks_base

core/java/android/net/IConnectivityManager.aidl

+2 −0

Original line number	Diff line number	Diff line
		@@ -119,6 +119,8 @@ interface IConnectivityManager

		boolean prepareVpn(String oldPackage, String newPackage);

		void markSocketAsUser(in ParcelFileDescriptor socket, int uid);

		ParcelFileDescriptor establishVpn(in VpnConfig config);

		void startLegacyVpn(in VpnProfile profile);

+27 −0

Original line number	Diff line number	Diff line
		@@ -1749,6 +1749,16 @@ public class ConnectivityService extends IConnectivityManager.Stub {
		"ConnectivityService");
		}

		private void enforceMarkNetworkSocketPermission() {
		//Media server special case
		if (Binder.getCallingUid() == Process.MEDIA_UID) {
		return;
		}
		mContext.enforceCallingOrSelfPermission(
		android.Manifest.permission.MARK_NETWORK_SOCKET,
		"ConnectivityService");
		}

		/**
		* Handle a {@code DISCONNECTED} event. If this pertains to the non-active
		* network, we ignore it. If it is for the active network, we send out a
		@@ -3350,6 +3360,23 @@ public class ConnectivityService extends IConnectivityManager.Stub {
		}
		}

		@Override
		public void markSocketAsUser(ParcelFileDescriptor socket, int uid) {
		enforceMarkNetworkSocketPermission();
		final long token = Binder.clearCallingIdentity();
		try {
		int mark = mNetd.getMarkForUid(uid);
		// Clear the mark on the socket if no mark is needed to prevent socket reuse issues
		if (mark == -1) {
		mark = 0;
		}
		NetworkUtils.markSocket(socket.getFd(), mark);
		} catch (RemoteException e) {
		} finally {
		Binder.restoreCallingIdentity(token);
		}
		}

		/**
		* Configure a TUN interface and return its file descriptor. Parameters
		* are encoded and opaque to this class. This method is used by VpnBuilder