commit 89dad013e4dd98434b0409a84567f38782894029
author Sreeram Ramachandran <sreeram@google.com> Wed Jul 02 10:09:49 2014 -0700
committer Sreeram Ramachandran <sreeram@google.com> Wed Jul 02 10:09:49 2014 -0700
tree 553f59e0cdda0fa081e792ca56a458413cdbc385
parent 36ed53e37b2639681055b2d3d8777241e7dd6982

Keep track of users allowed to call protect() explicitly.

This is an API change between ConnectivityService and Netd.

The ownerUid was meant for this purpose, but it's insufficient, as apps need to
call protect() _before_ they create a VPN.

Bug: 15409918
Change-Id: If804aa106002e96d5ffb623d32db35fd76928367

server/NetworkController.cpp

diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index f062dcf..0e341e5 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -177,7 +177,7 @@
     return 0;
 }
 
-int NetworkController::createVpn(unsigned netId, uid_t ownerUid) {
+int NetworkController::createVpn(unsigned netId) {
     if (netId < MIN_NET_ID || netId > MAX_NET_ID) {
         ALOGE("invalid netId %u", netId);
         return -EINVAL;
@@ -189,7 +189,7 @@
     }
 
     android::RWLock::AutoWLock lock(mRWLock);
-    mNetworks[netId] = new VirtualNetwork(netId, ownerUid);
+    mNetworks[netId] = new VirtualNetwork(netId);
     return 0;
 }
 
@@ -331,6 +331,18 @@
     return modifyRoute(netId, interface, destination, nexthop, false, legacy, uid);
 }
 
+void NetworkController::allowProtect(const std::vector<uid_t>& uids) {
+    android::RWLock::AutoWLock lock(mRWLock);
+    mProtectableUsers.insert(uids.begin(), uids.end());
+}
+
+void NetworkController::denyProtect(const std::vector<uid_t>& uids) {
+    android::RWLock::AutoWLock lock(mRWLock);
+    for (uid_t uid : uids) {
+        mProtectableUsers.erase(uid);
+    }
+}
+
 Network* NetworkController::getNetworkLocked(unsigned netId) const {
     auto iter = mNetworks.find(netId);
     return iter == mNetworks.end() ? NULL : iter->second;