android如何在framework层禁止指定包名访问网络

本文思路来源于：

sprdroid_t1\packages\modules\Connectivity\tests\cts\net\src\android\net\cts\ConnectivityManagerTest.java

1、启用防火墙链路

    private static void setFirewallChainEnabled(Context context, int chain, boolean enable) {ConnectivityManager connectivityManager = (ConnectivityManager) context.getSystemService(Context.CONNECTIVITY_SERVICE);try {Class<?> clz = Class.forName("android.net.ConnectivityManager");Method method = clz.getMethod("setFirewallChainEnabled", int.class, boolean.class);method.setAccessible(true);method.invoke(connectivityManager, chain, enable);Log.e(TAG, "setFirewallChainEnabled: success");} catch (IllegalAccessException | InvocationTargetException | ClassNotFoundException |NoSuchMethodException e) {e.printStackTrace();Log.e(TAG, "setFirewallChainEnabled: failed --> " + e);}}

2、对指定uid应用启用防火墙规则

    private static void setUidFirewallRule(Context context, int chain, final int uid, int rule) {ConnectivityManager connectivityManager = (ConnectivityManager) context.getSystemService(Context.CONNECTIVITY_SERVICE);try {Class<?> clz = Class.forName("android.net.ConnectivityManager");Method method = clz.getMethod("setUidFirewallRule", int.class, int.class, int.class);method.setAccessible(true);method.invoke(connectivityManager, chain, uid, rule);Log.e(TAG, "setUidFirewallRule: success");} catch (IllegalAccessException | InvocationTargetException | ClassNotFoundException |NoSuchMethodException e) {e.printStackTrace();Log.e(TAG, "setUidFirewallRule: failed --> " + e);}}

3、接口封装

/*** 限制指定包名应用是否可以访问网络** 需要权限（android.uid.system）：* android.permission.NETWORK_SETTINGS* android.permission.NETWORK_STACK* android.permission.MAINLINE_NETWORK_STACK** @param pkg com.mmbox.xbrowser* @param allowNetwork 是否允许访问网络*/private static void setPackageNetworkPolicy(Context context, String pkg, boolean allowNetwork) {new Thread(new Runnable() {@Overridepublic void run() {try {ApplicationInfo ai = context.getPackageManager().getApplicationInfo(pkg, PackageManager.GET_ACTIVITIES);int uid = ai.uid;setFirewallChainEnabled(context, 2, true);setUidFirewallRule(context, 2, uid, allowNetwork ? 1 : 2);} catch (PackageManager.NameNotFoundException e) {throw new RuntimeException(e);}}}).start();}

4、在framework代码中任意可以执行到的地方调用

//禁止X浏览器访问网络
setPackageNetworkPolicy(this, "com.mmbox.xbrowser", false);

测试用例1，禁止访问网络：
setPackageNetworkPolicy(this, “com.mmbox.xbrowser”, false);

测试用例2，允许访问网络：
setPackageNetworkPolicy(this, “com.mmbox.xbrowser”, true);