From 931bdc3451829d9d778ada733c95f8fd4fde3fd0 Mon Sep 17 00:00:00 2001
From: Dave McCloskey <dlm@google.com>
Date: Thu, 19 May 2022 09:54:54 -0700
Subject: [PATCH] Enforce USE_ATTESTATION_VERIFICATION_SERVICE permission to
 call APIs.

Bug: 233223690
Test: atest AttestationVerificationTest
Test: removed permission from test AndroidManifest and verified failure
Change-Id: I6dda91bb0bdf52e8e1456c0a607c224528a6d24a
---
 .../security/AttestationVerificationManagerService.java    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/services/core/java/com/android/server/security/AttestationVerificationManagerService.java b/services/core/java/com/android/server/security/AttestationVerificationManagerService.java
index 863f2d1a762d3..2bf0b2cd4f4a9 100644
--- a/services/core/java/com/android/server/security/AttestationVerificationManagerService.java
+++ b/services/core/java/com/android/server/security/AttestationVerificationManagerService.java
@@ -16,6 +16,7 @@
 
 package com.android.server.security;
 
+import static android.Manifest.permission.USE_ATTESTATION_VERIFICATION_SERVICE;
 import static android.security.attestationverification.AttestationVerificationManager.PROFILE_PEER_DEVICE;
 import static android.security.attestationverification.AttestationVerificationManager.PROFILE_SELF_TRUSTED;
 import static android.security.attestationverification.AttestationVerificationManager.RESULT_FAILURE;
@@ -60,6 +61,7 @@ public class AttestationVerificationManagerService extends SystemService {
                 Bundle requirements,
                 byte[] attestation,
                 AndroidFuture resultCallback) throws RemoteException {
+            enforceUsePermission();
             try {
                 Slog.d(TAG, "verifyAttestation");
                 verifyAttestationForAllVerifiers(profile, localBindingType, requirements,
@@ -73,9 +75,14 @@ public class AttestationVerificationManagerService extends SystemService {
         @Override
         public void verifyToken(VerificationToken token, ParcelDuration parcelDuration,
                 AndroidFuture resultCallback) throws RemoteException {
+            enforceUsePermission();
             // TODO(b/201696614): Implement
             resultCallback.complete(RESULT_UNKNOWN);
         }
+
+        private void enforceUsePermission() {
+            getContext().enforceCallingOrSelfPermission(USE_ATTESTATION_VERIFICATION_SERVICE, null);
+        }
     };
 
     private void verifyAttestationForAllVerifiers(