tree 5de8dbfaead419456f0a1d7393d16ebf4fabc513
parent 418de29604ba353365f8108f13ca4afe4310ff94
author Patrick Rohr <prohr@google.com> 1713897381 -0700
committer Patrick Rohr <prohr@google.com> 1713978095 -0700

Support allowing a UID to bypass VPNs only on a specific network

Until now, allowProtect() protected the UID from a VPN no matter the
network. In this scenario, in order to support CCT for CaptivePortal,
Chrome would have to be granted the ability to protect itself from VPN
no matter the network it is currently using.

This change adds a netId to mProtectableUsers, so allowProtect() can
either apply globally (using NETID_UNSET), a specific network, or both.
UIDs that can protect their sockets on specific networks cannot protect
their sockets from VPNs in general. They can only bypass VPNs when
explicitly binding sockets to the specified network.

Test: TH
Change-Id: Ide7c3e76f28ce89a45673667c05b46f1e61d3f74