tree 679dfd1539cda966db0cf080c83a72096767ebea
parent 8ae6128b05783e2393265154d05064b66cefe8f6
author Luke Huang <huangluke@google.com> 1592305802 +0800
committer Luke Huang <huangluke@google.com> 1592999937 +0000

Disable sockets and DNS if process lacks INTERNET permission.

This is a Client-only solution.
  - Add to NetdClient a per-process std::atomic_boolean
    similar to netIdForProcess and netIdForResolv.
  - The boolean says whether the process should be
    allowed Internet connectivity.
  - Add an @hide method to NetUtils.java to set the boolean;
    call it from the initialization code of the new
    process just after forking from zygote.
  - Make netdClientSocket and dnsOpenProxy check the
    boolean. If the boolean is false, return EPERM from
    socket calls.

Bug: 150028556
Test: atest NetworkUtilsTest
Test: atest CtsAppSecurityHostTestCases:UseProcessTest
(cherry-pick from internal branch, ag/11881939)
Merged-In: If002280fbad493dfc2db3d9d505c0257d49a9056
Change-Id: If002280fbad493dfc2db3d9d505c0257d49a9056