Firewall apps use VPN to manage network (to allow or disallow apps to connect to the Internet via Wifi or Mobile Data), mainly is for phones that are not rooted.

However, the article (https://www.androidpolice.com/2018/05/07/apps-android-p-will-no-longer-able-monitor-network-activity/) mentions

As XDA Developers explains, access to proc/net is going to be tightened up so that only designated VPN apps will be allowed to read TCP and UDP files (and in turn interpret network activity).

Even though I support that Android should have features to allow or disallow Apps to have Internet access, BUT this wonderful feature may not even applies to Android or Google apps itself. (such as the data hungry Google Play Store and Google Play Services apps!)

Thus, if only designated VPN apps are allowed, this means that phones that is not rooted will no longer be able to use Firewall apps that use VPN to manage network! This is totally unacceptable!

If Android 9 (Android Pie) do not allow end-user to be able to control the network for the famous and notoriously data hungry Google Play Store and Google Play Services apps (that self update without permission from end-user), then it will implies that Google and Android have fail the city by disregard end-user concern on network usages!

Therefore, I would like to know if Android 9 will result in such unfair and despicable behaviors.

  • If Google really wanted to let users control internet connectivity, "permission.INTERNET" should have been in DANGEROUS category or at least they could expose it through AppOps. Android is a world of targeted advertising through online tracking and profiling, though no doubt they try to protect user's privacy and security from certain aspects. Device is yours, you must be given the right to restrict connectivity of even the daemons running as root – Irfan Latif Dec 18 '18 at 10:07

Have a read of the commit on googlesource here. It states

Files in /proc/net leak information. This change is the first step in determining which files apps may use, whitelisting benign access, and otherwise removing access while providing safe alternative APIs.


  • Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing use by VPN apps. This may be replaced by an alternative API.
  • Audits all other proc/net access for apps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.