tree 5ce90554dba137abc18c29443ff368be5c80dece
parent abe885124b91a6899e14176969893739860cbfb2
author Chad Brubaker <cbrubaker@google.com> 1392413069 -0800
committer Chad Brubaker <cbrubaker@google.com> 1394055336 -0800

Only allow System apps to make VPN exempt routes

requestRouteToHost will only allow system applications to make routes
exempt from the VPN's routing rules.

If a VPN is currently running and a non-system app requests a route it
will only succeed if that host is currently covered by a VPN exempt
routing rule. Otherwise it will fail.

For example, if a VPN is running and the MMS network is brought online
those routes will be added as VPN exempt. If an application then tries
to request a route to a MMS endpoint it will succeed because the routes
already exist. If an application tries to request a route to a host
covered by the VPN the call will fail.

Bug: 12937545
Change-Id: If7bcec91bbb96c62c8fb69748c975847e6c00b6f