From 36f8a877e9073e2e0e3e806bec48a7c4475d3039 Mon Sep 17 00:00:00 2001
From: Kangping Dong <wgtdkp@google.com>
Date: Wed, 15 May 2024 20:37:02 +0800
Subject: [Thread] add permission THREAD_NETWORK_TESTING for guarding testing
 APIs or shell commands

For new Thread network APIs or shell command for only testing, a new
signature permission is deversed to protect them (so to distinguish them
from existing system APIs which are designed for privileged apps such as
GMS Core).

Bug: 329368792
Change-Id: I291989eb0e024614568044945726edc07e20b8be
---
 core/res/AndroidManifest.xml       | 5 +++++
 packages/Shell/AndroidManifest.xml | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index ee7baa171cf0..cf552da676a2 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2258,6 +2258,11 @@
     <permission android:name="android.permission.THREAD_NETWORK_PRIVILEGED"
                 android:protectionLevel="signature|privileged" />
 
+    <!-- @hide Allows access to Thread network APIs or shell commands ("cmd thread_network") which
+        are only for testing. -->
+    <permission android:name="android.permission.THREAD_NETWORK_TESTING"
+                android:protectionLevel="signature" />
+
     <!-- #SystemApi @hide Allows an app to bypass Private DNS.
          <p>Not for use by third-party applications.
          TODO: publish as system API in next API release. -->
diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml
index bacab0f8f1e8..00e17f50076d 100644
--- a/packages/Shell/AndroidManifest.xml
+++ b/packages/Shell/AndroidManifest.xml
@@ -602,6 +602,8 @@
 
     <!-- Permission required for CTS test - CtsThreadNetworkTestCases -->
     <uses-permission android:name="android.permission.THREAD_NETWORK_PRIVILEGED"/>
+    <!-- Permission required to access Thread network shell commands for testing -->
+    <uses-permission android:name="android.permission.THREAD_NETWORK_TESTING"/>
 
     <!-- Permission required for CTS tests to enable/disable rate limiting toasts. -->
     <uses-permission android:name="android.permission.MANAGE_TOAST_RATE_LIMITING" />
-- 
cgit v1.2.3-59-g8ed1b