tree c5b092198748561fd8b04e94bd476fd3472052e1
parent 593f1e8176d652db79d43892882c238ccf6c937b
author Luke Huang <huangluke@google.com> 1592305802 +0800
committer Luke Huang <huangluke@google.com> 1592449326 +0000

Disable sockets and DNS if process lacks INTERNET permission.

This is a Client-only solution.
  - Add to NetdClient a per-process std::atomic_boolean
    similar to netIdForProcess and netIdForResolv.
  - The boolean says whether the process should be
    allowed Internet connectivity.
  - Add an @hide method to NetUtils.java to set the boolean;
    call it from the initialization code of the new
    process just after forking from zygote.
  - Make netdClientSocket and dnsOpenProxy check the
    boolean. If the boolean is false, return EPERM from
    socket calls.

Bug: 150028556
Test: atest NetworkUtilsTest
Test: atest CtsAppSecurityHostTestCases:UseProcessTest
Change-Id: If002280fbad493dfc2db3d9d505c0257d49a9056
Exempt-From-Owner-Approval: OWNERS already approved identical patchset 5