详解Android利用Iptables实现网络黑白名单(防火墙)

type fxjnet_service, system_api_service, system_server_service, service_manager_type;

fxjnet      u:object_r:fxjnet_service:s0

public static final String FXJNET_SERVICE="fxjnet";

registerService(Context.FXJNET_SERVICE, FXJNETManager.class,
       new CachedServiceFetcher() {
       @Override
       public FXJNETManager createService(ContextImpl ctx) {
       IBinder b = ServiceManager.getService(Context.FXJNET_SERVICE);
       IFXJNETService service = IFXJNETService.Stub.asInterface(b);
       return new FXJNETManager(ctx, service);
 }});

ServiceManager.addService(Context.FXJNET_SERVICE, new FXJNETService());

package android.os;
interface IFXJNETService{
  void addNetworkRestriction(List ipName,int type);
}

package android.app;
import android.os.IFXJNETService;
import android.os.RemoteException;
import android.content.Context;
public class FXJNETManager{

 IFXJNETService mService;
 public FXJNETManager(Context ctx,IFXJNETService service){
    mService=service;
 }
 public void addNetworkRestriction(List ipName,int type) {
    try{
      mService.addNetworkRestriction(ipName,type);
   }catch (RemoteException e){
   }
 }//end addNetworkRestriction
}

package com.android.server;

import android.os.IFXJNETService;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;

public class FXJNETService extends IFXJNETService.Stub {
final File file = new File("/data/fxj/", "firewall.sh");
  /**
   * 增加{网络IP访问}黑白名单数据
   */
  public void addNetworkRestriction(List ipName,int type) {
      String str= getIPlist(type,ipName);
      setiptablesRestriction();
  }
//构建Iptables的规则，1-黑名单 ；2-白名单
 private String getIPlist(int type,List iplist){
    StringBuilder sb = new StringBuilder();
    sb.append("echo runscript start\n");
    sb.append("iptables -F OUTPUT\n");
    if (type == 1){
      if (iplist != null && iplist.size() > 0){
        for (int i = 0 ; i  0){
        for (int i = 0 ; i 

package com.android.server;

import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStreamWriter;

import android.os.FileUtils;
import android.os.SystemProperties;
import android.util.Log;

public class FXJScriptRunner extends Thread{
  private final File file;
  private final String script;
  private final StringBuilder res;
  public int exitcode = -1;
  private final String TAG = "ScriptRunner" ;
  
  public ScriptRunner(File file, String script, StringBuilder res,
      boolean asroot) {
    this.file = file;
    this.script = script;
    this.res = res;
  }

  @Override
  public void run() {
    // TODO Auto-generated method stub
    try {
      file.delete();
      file.createNewFile();
      final String abspath = file.getAbsolutePath();
      // make sure we have execution permission on the script file
      FileUtils.setPermissions(abspath, 00700, -1, -1);
      Runtime.getRuntime().exec("chmod 777 " + abspath).waitFor();//给创建的sh文件设置权限
      // Write the script to be executed
      final OutputStreamWriter out = new OutputStreamWriter(
          new FileOutputStream(file));
      if (new File("/system/bin/sh").exists()) {
        out.write("#!/system/bin/sh\n");
      }
      out.write(script);
      if (!script.endsWith("\n"))
        out.write("\n");
      out.write("exit 0\n");
      out.flush();
      out.close();
//通过 SystemProperties.set("ctl.start", "fxjmotnitor")执行service，来运行脚本，
//fxjmotnitor为service名称,可以根据自己的爱好随便叫
      SystemProperties.set("ctl.start", "fxjmotnitor");
    } catch (Exception ex) {
      if (res != null)
        res.append("\n" + ex);
    } finally {
      //destroy();
    }
  }
}

service fxjmotnitor /system/bin/sh /data/fxj/firewall.sh
 class main
 oneshot
 seclabel u:r:fxjmotnitor:s0

type fxjmotnitor, domain;
type fxjmotnitor_exec, exec_type, file_type;
init_daemon_domain(fxjmotnitor)
allow fxjmotnitor shell_exec:file { entrypoint getattr read };

/data/fxj/firewall.sh  u:object_r:fxjmotnitor_exec:s0

BOARD_SEPOLICY_UNION += \
#追加如下
......\
fxjmotnitor.te \
......\