Shulou(Shulou.com)06/01 Report--

In recent work, we need to develop a function-networking control, which is more useful than root Android should know, prohibit an application from connecting to the mobile network or wifi.

After root, you can control the network permissions of the application according to uid by executing the command of iptable through su

However, because the company is doing mobile phone system development, the production of mobile phones is not allowed to have root permissions, so we can not use root permissions to achieve this function.

As a result of doing this function for the first time, at first I naively thought that the interface in the system had this kind of control permission, and then there was only Internet permission, so I couldn't tell the difference between data traffic and wifi.

Well, it goes directly to the way it is finally realized.

At that time, it was found that there was a function on the mobile phone to limit the application background data traffic, which, as described by it, is to limit the application traffic that cannot be used in the background state. Through code tracing, it is found that it calls a NetworkManagementService.java Service, and the method is the following, in which the mConnector is used to encapsulate the class that sends the command. If you are interested, you can have a look for yourself-> NativeDaemonConnector.java

@ Override public void setUidNetworkRules (int uid, boolean rejectOnQuotaInterfaces) {mContext.enforceCallingOrSelfPermission (CONNECTIVITY_INTERNAL, TAG); / / silently discard when control disabled / / TODO: eventually migrate to be always enabled if (! mBandwidthControlEnabled) return; synchronized (mQuotaLock) {final boolean oldRejectOnQuota = mUidRejectOnQuota.get (uid, false); if (oldRejectOnQuota = = rejectOnQuotaInterfaces) {/ / TODO: eventually consider throwing return } try {mConnector.execute ("bandwidth", rejectOnQuotaInterfaces? "addnaughtyapps": "removenaughtyapps", uid); if (rejectOnQuotaInterfaces) {mUidRejectOnQuota.put (uid, true);} else {mUidRejectOnQuota.delete (uid);}} catch (NativeDaemonConnectorException e) {throw e.rethrowAsParcelableException ();}

By searching for the keyword addnaughtyapps, the place where the command is parsed is found in the class CommandListener.cpp

If (! strcmp (argv [1], "addnaughtyapps") | |! strcmp (argv [1], "ana")) {if (argc)

AddNaughtyApps (argc-2, argv + 2); sendGenericOkFail (cli, rc); return 0;}

Finally, execute the command to operate iptable in the class BandwidthController.cpp.

Ok, since this Service has the permission to execute iptable directly, let's just add the method we need to OK.

therefore,

1. The judgment of adding filter keywords to CommandListener.cpp

two。 Add an interface to NetworkManagementService.java to send commands

3. The final implementation is carried out in BandwidthController.cpp.

The third step is mainly the operation of iptable, how to use a lot of online, but I really watched for a long time to understand the operation of iptable. The main ones used are the-I and-D commands.

In fact, I am more curious about how the netd process has permission to execute root commands than these. Be sure to study it when you are free.

Currently only know that in init.rc can be configured with root permissions to start service.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.