Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6cebc2f2 authored by Mustafa Acer's avatar Mustafa Acer Committed by Mustafa Emre Acer
Browse files

Add a new permission for external time sources 

This CL adds a new permission called SUGGEST_EXTERNAL_TIME that
gates TimeManager.suggestExternalTime calls.

The new permission is marked as 'privileged' as protection level. This
could result in third party apps preinstalled on the system image to
potentially get this permission. This is OK for the following reasons:
 - OEM coordination is needed to grant 3P apps this permission, so
 adding "privileged" doesn't introduce significant risk.
 - This permission/API doesn't guarantee that the suggested timestamp
 will immediately be used as the new system timestamp. The system must
 be configured so that the external time source has a higher priority
 than other time sources (e.g. GNSS) for the external time suggestion to
 be used. This configuration is also done by the OEM. That introduces
 significant roadblock for a malicious app to do anything useful with
 this permission.
- More importantly, apps can set system time directly using
TimeManager.setTime() which requires SET_TIME permission. This
permission is also signature|privileged, so this change is consistent
with it.

Bug: 157504928, 177079827
CTS-Coverage-Bug: 182275086
Test: atest android.app.time
Change-Id: I0098ab7565b647fb220d39575f0616d2a47bdc89
parent 934f10e6

core/api/system-current.txt

+1 −0
Original line number Diff line number Diff line
@@ -267,6 +267,7 @@ package android { 
    field public static final String STOP_APP_SWITCHES = "android.permission.STOP_APP_SWITCHES";

    field public static final String SUBSTITUTE_NOTIFICATION_APP_NAME = "android.permission.SUBSTITUTE_NOTIFICATION_APP_NAME";

    field public static final String SUBSTITUTE_SHARE_TARGET_APP_NAME_AND_ICON = "android.permission.SUBSTITUTE_SHARE_TARGET_APP_NAME_AND_ICON";

    field public static final String SUGGEST_EXTERNAL_TIME = "android.permission.SUGGEST_EXTERNAL_TIME";

    field public static final String SUSPEND_APPS = "android.permission.SUSPEND_APPS";

    field public static final String SYSTEM_APPLICATION_OVERLAY = "android.permission.SYSTEM_APPLICATION_OVERLAY";

    field public static final String SYSTEM_CAMERA = "android.permission.SYSTEM_CAMERA";

core/java/android/app/time/TimeManager.java

+1 −1
Original line number Diff line number Diff line
@@ -264,7 +264,7 @@ public final class TimeManager { 
     * See {@link ExternalTimeSuggestion} for more details.

     * {@hide}

     */

    @RequiresPermission(android.Manifest.permission.SET_TIME)

    @RequiresPermission(android.Manifest.permission.SUGGEST_EXTERNAL_TIME)

    public void suggestExternalTime(@NonNull ExternalTimeSuggestion timeSuggestion) {

        if (DEBUG) {

            Log.d(TAG, "suggestExternalTime called: " + timeSuggestion);

core/res/AndroidManifest.xml

+9 −0
Original line number Diff line number Diff line
@@ -2963,6 +2963,15 @@ 
    <permission android:name="android.permission.SUGGEST_MANUAL_TIME_AND_ZONE"

        android:protectionLevel="signature" />



    <!-- Allows system clock time suggestions from an external clock / time source to be made.

         The nature of "external" could be highly form-factor specific. Example, times

         obtained via the VHAL for Android Auto OS.

         <p>Not for use by third-party applications.

         @SystemApi @hide

    -->

    <permission android:name="android.permission.SUGGEST_EXTERNAL_TIME"

        android:protectionLevel="signature|privileged" />



    <!-- Allows applications like settings to manage configuration associated with automatic time

         and time zone detection.

         <p>Not for use by third-party applications.

services/core/java/com/android/server/timedetector/TimeDetectorService.java

+1 −1
Original line number Diff line number Diff line
@@ -228,7 +228,7 @@ public final class TimeDetectorService extends ITimeDetectorService.Stub { 
    private void enforceSuggestExternalTimePermission() {

        // We don't expect a call from system server, so simply enforce calling permission.

        mContext.enforceCallingPermission(

                android.Manifest.permission.SET_TIME,

                android.Manifest.permission.SUGGEST_EXTERNAL_TIME,

                "suggest time from external source");

    }

services/tests/servicestests/src/com/android/server/timedetector/TimeDetectorServiceTest.java

+3 −3
Original line number Diff line number Diff line
@@ -217,20 +217,20 @@ public class TimeDetectorServiceTest { 
            fail();

        } finally {

            verify(mMockContext).enforceCallingPermission(

                    eq(android.Manifest.permission.SET_TIME), anyString());

                    eq(android.Manifest.permission.SUGGEST_EXTERNAL_TIME), anyString());

        }

    }



    @Test

    public void testSuggestExternalTime() throws Exception {

        doNothing().when(mMockContext).enforceCallingOrSelfPermission(anyString(), any());

        doNothing().when(mMockContext).enforceCallingPermission(anyString(), any());



        ExternalTimeSuggestion externalTimeSuggestion = createExternalTimeSuggestion();

        mTimeDetectorService.suggestExternalTime(externalTimeSuggestion);

        mTestHandler.assertTotalMessagesEnqueued(1);



        verify(mMockContext).enforceCallingPermission(

                eq(android.Manifest.permission.SET_TIME), anyString());

                eq(android.Manifest.permission.SUGGEST_EXTERNAL_TIME), anyString());



        mTestHandler.waitForMessagesToBeProcessed();

        mStubbedTimeDetectorStrategy.verifySuggestExternalTimeCalled(externalTimeSuggestion);