Return ECONNREFUSED when socket creation blocked
Fail gracefully when restricted apps try to perform DNS lookups.
If an app cannot create an inet socket, this means network access is
blocked for the uid, so we must not allow it to resolve DNS. However,
when we do not return a socket/file descriptor to dnsproxyd in
dns_open_proxy, bionic attempts to resolve DNS directly rather than
through dnsproxyd, which requires creating an inet socket. This fails,
too, which leads to a SecurityException complaining about an app
lacking the INTERNET permission, unless we alter the errno from
EPERM to something else. We change it to ECONNREFUSED.
Requires: I912a4a2ee78a29ca8b7d8ff85e5ad7cf617c31a5
Co-authored-by: Oliver Scott <olivercscott@gmail.com>
Issue: calyxos#581
Change-Id: I7939ee036c9c25a3f7827742194f8469fb13ba49
Signed-off-by: Jis G Jacob <studiokeys@blissroms.org>
1 file changed