From af8e7021eba7e060f1dbb9c41565b33574264065 Mon Sep 17 00:00:00 2001
From: Rusty Bird <rustybird@openmailbox.org>
Date: Wed, 11 Jan 2017 14:35:54 +0000
Subject: [system/netd] Copy client's uid and gid into thread's fsuid and fsgid

Inspired by
https://github.com/cernekee/dnsproxy2/commit/0708140aa747764a125b5189cace005773e30a24
---
 server/DnsProxyListener.cpp | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/server/DnsProxyListener.cpp b/server/DnsProxyListener.cpp
index 8ecfcdc..5517f0b 100644
--- a/server/DnsProxyListener.cpp
+++ b/server/DnsProxyListener.cpp
@@ -22,6 +22,7 @@
 #include <netdb.h>
 #include <netinet/in.h>
 #include <stdlib.h>
+#include <sys/fsuid.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #include <string.h>
@@ -185,6 +186,22 @@ static bool sendaddrinfo(SocketClient* c, struct addrinfo* ai) {
     return true;
 }
 
+// Copy the client's uid and gid into the thread's fsuid and fsgid,
+// so Netfilter rules can see who caused subsequent DNS packets
+static bool setfsids(SocketClient* c) {
+    bool success = true;
+
+    if (setfsuid(c->getUid()) != 0) {
+        ALOGE("setfsids setfsuid errno: %s\n", strerror(errno));
+        success = false;
+    }
+    if (setfsgid(c->getGid()) != 0) {
+        ALOGE("setfsids setfsgid errno: %s\n", strerror(errno));
+        success = false;
+    }
+    return success;
+}
+
 void DnsProxyListener::GetAddrInfoHandler::run() {
     if (DBG) {
         ALOGD("GetAddrInfoHandler, now for %s / %s / {%u,%u,%u,%u,%u}", mHost, mService,
@@ -193,6 +210,10 @@ void DnsProxyListener::GetAddrInfoHandler::run() {
                 mNetContext.uid);
     }
 
+    if (!setfsids(mClient)) {
+        return;
+    }
+
     struct addrinfo* result = NULL;
     Stopwatch s;
     uint32_t rv = android_getaddrinfofornetcontext(mHost, mService, mHints, &mNetContext, &result);
@@ -377,6 +398,10 @@ void DnsProxyListener::GetHostByNameHandler::run() {
         ALOGD("DnsProxyListener::GetHostByNameHandler::run\n");
     }
 
+    if (!setfsids(mClient)) {
+        return;
+    }
+
     Stopwatch s;
     struct hostent* hp = android_gethostbynamefornet(mName, mAf, mNetId, mMark);
     const int latencyMs = lround(s.timeTaken());
@@ -498,6 +523,11 @@ void DnsProxyListener::GetHostByAddrHandler::run() {
     if (DBG) {
         ALOGD("DnsProxyListener::GetHostByAddrHandler::run\n");
     }
+
+    if (!setfsids(mClient)) {
+        return;
+    }
+
     struct hostent* hp;
 
     // NOTE gethostbyaddr should take a void* but bionic thinks it should be char*
-- 
2.1.4