From 6cebc2f2ac13fcc4430d3180195694761710f9a2 Mon Sep 17 00:00:00 2001
From: Mustafa Acer <meacer@google.com>
Date: Thu, 11 Mar 2021 18:38:27 +0000
Subject: [PATCH] Add a new permission for external time sources

This CL adds a new permission called SUGGEST_EXTERNAL_TIME that
gates TimeManager.suggestExternalTime calls.

The new permission is marked as 'privileged' as protection level. This
could result in third party apps preinstalled on the system image to
potentially get this permission. This is OK for the following reasons:
 - OEM coordination is needed to grant 3P apps this permission, so
 adding "privileged" doesn't introduce significant risk.
 - This permission/API doesn't guarantee that the suggested timestamp
 will immediately be used as the new system timestamp. The system must
 be configured so that the external time source has a higher priority
 than other time sources (e.g. GNSS) for the external time suggestion to
 be used. This configuration is also done by the OEM. That introduces
 significant roadblock for a malicious app to do anything useful with
 this permission.
- More importantly, apps can set system time directly using
TimeManager.setTime() which requires SET_TIME permission. This
permission is also signature|privileged, so this change is consistent
with it.

Bug: 157504928, 177079827
CTS-Coverage-Bug: 182275086
Test: atest android.app.time
Change-Id: I0098ab7565b647fb220d39575f0616d2a47bdc89
---
 core/api/system-current.txt                              | 1 +
 core/java/android/app/time/TimeManager.java              | 2 +-
 core/res/AndroidManifest.xml                             | 9 +++++++++
 .../android/server/timedetector/TimeDetectorService.java | 2 +-
 .../server/timedetector/TimeDetectorServiceTest.java     | 6 +++---
 5 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index a0e0f7133a257..5c2b878d84315 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -267,6 +267,7 @@ package android {
     field public static final String STOP_APP_SWITCHES = "android.permission.STOP_APP_SWITCHES";
     field public static final String SUBSTITUTE_NOTIFICATION_APP_NAME = "android.permission.SUBSTITUTE_NOTIFICATION_APP_NAME";
     field public static final String SUBSTITUTE_SHARE_TARGET_APP_NAME_AND_ICON = "android.permission.SUBSTITUTE_SHARE_TARGET_APP_NAME_AND_ICON";
+    field public static final String SUGGEST_EXTERNAL_TIME = "android.permission.SUGGEST_EXTERNAL_TIME";
     field public static final String SUSPEND_APPS = "android.permission.SUSPEND_APPS";
     field public static final String SYSTEM_APPLICATION_OVERLAY = "android.permission.SYSTEM_APPLICATION_OVERLAY";
     field public static final String SYSTEM_CAMERA = "android.permission.SYSTEM_CAMERA";
diff --git a/core/java/android/app/time/TimeManager.java b/core/java/android/app/time/TimeManager.java
index c8fa5c8f28e2d..c71badb0d484e 100644
--- a/core/java/android/app/time/TimeManager.java
+++ b/core/java/android/app/time/TimeManager.java
@@ -264,7 +264,7 @@ public final class TimeManager {
      * See {@link ExternalTimeSuggestion} for more details.
      * {@hide}
      */
-    @RequiresPermission(android.Manifest.permission.SET_TIME)
+    @RequiresPermission(android.Manifest.permission.SUGGEST_EXTERNAL_TIME)
     public void suggestExternalTime(@NonNull ExternalTimeSuggestion timeSuggestion) {
         if (DEBUG) {
             Log.d(TAG, "suggestExternalTime called: " + timeSuggestion);
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index e6081a4a93092..5aaf1fcafe1ba 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2963,6 +2963,15 @@
     <permission android:name="android.permission.SUGGEST_MANUAL_TIME_AND_ZONE"
         android:protectionLevel="signature" />
 
+    <!-- Allows system clock time suggestions from an external clock / time source to be made.
+         The nature of "external" could be highly form-factor specific. Example, times
+         obtained via the VHAL for Android Auto OS.
+         <p>Not for use by third-party applications.
+         @SystemApi @hide
+    -->
+    <permission android:name="android.permission.SUGGEST_EXTERNAL_TIME"
+        android:protectionLevel="signature|privileged" />
+
     <!-- Allows applications like settings to manage configuration associated with automatic time
          and time zone detection.
          <p>Not for use by third-party applications.
diff --git a/services/core/java/com/android/server/timedetector/TimeDetectorService.java b/services/core/java/com/android/server/timedetector/TimeDetectorService.java
index eefa045abe1b9..27e2ee585a208 100644
--- a/services/core/java/com/android/server/timedetector/TimeDetectorService.java
+++ b/services/core/java/com/android/server/timedetector/TimeDetectorService.java
@@ -228,7 +228,7 @@ public final class TimeDetectorService extends ITimeDetectorService.Stub {
     private void enforceSuggestExternalTimePermission() {
         // We don't expect a call from system server, so simply enforce calling permission.
         mContext.enforceCallingPermission(
-                android.Manifest.permission.SET_TIME,
+                android.Manifest.permission.SUGGEST_EXTERNAL_TIME,
                 "suggest time from external source");
     }
 
diff --git a/services/tests/servicestests/src/com/android/server/timedetector/TimeDetectorServiceTest.java b/services/tests/servicestests/src/com/android/server/timedetector/TimeDetectorServiceTest.java
index 106827078290e..742f5034a248c 100644
--- a/services/tests/servicestests/src/com/android/server/timedetector/TimeDetectorServiceTest.java
+++ b/services/tests/servicestests/src/com/android/server/timedetector/TimeDetectorServiceTest.java
@@ -217,20 +217,20 @@ public class TimeDetectorServiceTest {
             fail();
         } finally {
             verify(mMockContext).enforceCallingPermission(
-                    eq(android.Manifest.permission.SET_TIME), anyString());
+                    eq(android.Manifest.permission.SUGGEST_EXTERNAL_TIME), anyString());
         }
     }
 
     @Test
     public void testSuggestExternalTime() throws Exception {
-        doNothing().when(mMockContext).enforceCallingOrSelfPermission(anyString(), any());
+        doNothing().when(mMockContext).enforceCallingPermission(anyString(), any());
 
         ExternalTimeSuggestion externalTimeSuggestion = createExternalTimeSuggestion();
         mTimeDetectorService.suggestExternalTime(externalTimeSuggestion);
         mTestHandler.assertTotalMessagesEnqueued(1);
 
         verify(mMockContext).enforceCallingPermission(
-                eq(android.Manifest.permission.SET_TIME), anyString());
+                eq(android.Manifest.permission.SUGGEST_EXTERNAL_TIME), anyString());
 
         mTestHandler.waitForMessagesToBeProcessed();
         mStubbedTimeDetectorStrategy.verifySuggestExternalTimeCalled(externalTimeSuggestion);