diff options
| author | Ken Chen <cken@google.com> | 2021-03-30 01:41:00 +0800 |
|---|---|---|
| committer | Maciej Żenczykowski <maze@google.com> | 2021-03-30 13:55:52 +0000 |
| commit | dfbb19b75abf2d3580e9c9d3c11a5ffe211c4103 (patch) | |
| tree | 3696f7922667962ca129a6fbcbd59b33f2dcb6bc /server/NetworkController.cpp | |
| parent | 4e8ef9b24e5f5c1f9760f593e2e022750c314f5e (diff) | |
Restrict apps from using the 'unreachable network'
The unreachable network in Netd is designed for PANS feature. Disallow
arbitrary apps to use it, or it may become harder to change and/or
difficult or impossible to delete when apps start to depend on.
Test: atest
Change-Id: Iee6edd24ef5c2383a125a2b78ce63951f6da9d16
Diffstat (limited to 'server/NetworkController.cpp')
| -rw-r--r-- | server/NetworkController.cpp | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp index 65658a52..14a4aa60 100644 --- a/server/NetworkController.cpp +++ b/server/NetworkController.cpp @@ -829,10 +829,9 @@ int NetworkController::checkUserNetworkAccessLocked(uid_t uid, unsigned netId) c mProtectableUsers.find(uid) == mProtectableUsers.end()) { return -EPERM; } - // Anyone can use unreachable network if they want. That being said, PANS should be the only - // user so far. + // Only apps that are configured as "no default network" can use the unreachable network. if (network->isUnreachable()) { - return 0; + return network->appliesToUser(uid) ? 0 : -EPERM; } // If the UID wants to use a physical network and it has a UID range that includes the UID, the // UID has permission to use it regardless of whether the permission bits match. |