Add per-app foreground-only internet access restriction

[Copilot]

Implements a feature allowing users to restrict app internet access to foreground (active use) only, addressing requests to "block internet access when an app is not used."

Implementation

Core tracking (ForegroundTracker.java)

• Monitors foreground apps via UsageStatsManager with 500ms throttling
• Requires PACKAGE_USAGE_STATS permission; prompts user via Settings when enabled
• Thread-safe caching with concurrent data structures

Packet filtering (ServiceSinkhole.java)

• Added foreground check in isAddressAllowed() before packet approval
• UID-level caching for foreground-only settings (cleared on regular maintenance)
• Graceful fallback: allows traffic if permission not granted (logs warning once per UID)

UI (AdapterRule.java, rule.xml)

• Checkbox in expanded app details: "Allow only when in use"
• Permission request flow integrated into toggle handler
• Uses existing SharedPreferences pattern for persistence

Data model (Rule.java)

• Added foreground_only boolean field
• Loaded from foreground_only SharedPreferences namespace

Technical notes

• Package name selection for shared UIDs: sorts packages alphabetically for determinism
• Performance: cache hit path avoids PackageManager and SharedPreferences lookups
• State transitions: clear-and-rebuild pattern ensures background apps are properly unmarked

Example usage

// In packet filtering hot path
Boolean isForegroundOnly = foregroundOnlyCache.get(packet.uid);
if (isForegroundOnly && !ForegroundTracker.getInstance(this).isAppInForeground(packet.uid)) {
    packet.allowed = false; // Block background traffic
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -Xmx4608m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-8.13-bin/5xuhj0ry160q40clulazy9h7d/gradle-8.13/lib/gradle-daemon-main-8.13.jar (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Allow internet access only when using an app</issue_title>
<issue_description>Pleade, add an option to block internet access when an app is not used.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Allow internet access only when using an app #509

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.