Processes/applications access the network (WiFi-based or GSM-based networks) using network sockets. Java code makes use of the Apache Harmony socket implementation and native code uses standard bionic sockets that are identical to libc socket calls. There is no Internet service. In this recipe, we will analyze how the network is accessed and how these accesses are guarded.
We will look at a kernel source file in this recipe, so locate the kernel sources you had downloaded and built in the first recipe of this book.
The code for network access in Java is implemented in the Apache Harmony library in OSNetworkSystem.java located at ANDROID_SRC/libcore/luni/src/main/java/org/apache/harmony/luni/platform.
This is the final point before native socket calls are invoked.
Navigate to the kernel sources we downloaded and built in the introductory recipe of this book.
Open the file
ANDROID_SRC/kernel_code/goldfish/goldfish/net/ipv4/af_inet.c.In this file, we observe the following addition:
#ifdef CONFIG_ANDROID_PARANOID_NETWORK #include <linux/android_aid.h> static inline int current_has_network(void) { return in_egroup_p(AID_INET) || capable(CAP_NET_RAW); } #else static inline int current_has_network(void) { return 1; } #endifThis function makes a check as to whether the process currently executing in a function call is part of the
AID_INETgroup or not. For example, look at the function namedinet_create.There is a call to
current_has_network()and, if not, it returns-EACCES.
The OSNetworkSystem.java file contains native methods that ultimately make use of libc socket calls to perform I/O on the network. System library calls eventually invoke system calls implemented in the kernel. On Android, the network calls were changed to only allow execution if the process currently executing the system call belongs to a particular group. That group is named inet.
When an application requests android.permission.INTERNET, and when it is about to be run, the Package Manager service notifies Zygote that the application is to be run as part of the inet group.
Later on, the modified system calls verify that the process is running as a member of inet and the call succeeds.
The current_has_network() function makes use of the function in_egroup_p(gid_t) to check the group identifier of the process executing it. An Android process runs as a member of this group only if it has been granted android.permission.INTERNET.
The system applications are installed on the system/read-only partition of an Android device. The applications are signed with the one of system certificates (There are four certificates: testkey, platform, shared, and media) and perform certain privileged tasks. Examples include the Contacts application and the Settings application. Sometimes, your design may require a change of these system applications. In the next recipe, we will learn the purpose of the most important system applications and learn how to compile changes made to them.