Android VPN service : How tun0 gets created?

[mayukha cheekati]

I would like to know how android creates a VPN tun0 interface. After I call establish from VPNService, Builder, the ServiceManager takes up the process and create the tun0. For that it uses parcels to send to Binder, but I am kind of confused as to what it does after that. I want to understand in detail how an interface gets created.

I have tried using strace on the application to see what kind of system calls get executed, but I did not see any ioctl calls from the application pid, but saw them on the system_Server pid. I understand that system_Server is what creates the interface, but how does Binder talk to system_Server asking to create an interface. Kindly point to any source code . It would be really helpful .