Support allowing a UID to bypass VPNs only on a specific network
Until now, allowProtect() protected the UID from a VPN no matter the
network. In this scenario, in order to support CCT for CaptivePortal,
Chrome would have to be granted the ability to protect itself from VPN
no matter the network it is currently using.
This change adds a netId to mProtectableUsers, so allowProtect() can
either apply globally (using NETID_UNSET), a specific network, or both.
UIDs that can protect their sockets on specific networks cannot protect
their sockets from VPNs in general. They can only bypass VPNs when
explicitly binding sockets to the specified network.
Test: TH
Change-Id: Ide7c3e76f28ce89a45673667c05b46f1e61d3f74
4 files changed
