Add enterprise policy for network time service

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index a9699fe8fe7c1f47edb5467251df43fc8cc04ced..a727a0a9f7686366cfa7476796b81e120f13fce1 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -143,7 +143,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 369
+#   For your editing convenience: highest ID currently used: 370
 #   And don't forget to also update the EnterprisePolicies enum of
 #   histograms.xml (run 'python tools/metrics/histograms/update_policies.py').
 #
@@ -9548,6 +9548,21 @@
 
       If this policy is left not set, the default is not allowed for enterprise-managed users and allowed for non-managed users.''',
     },
+    {
+      'name': 'NetworkTimeQueriesEnabled',

[Thiemo Nagel, 2017/05/26 11:06:51]

Potentially rename this to clarify that it doesn't apply to CrOS system daemons,
e.g. BrowserNetworkTimeQueriesEnabled?

[estark, 2017/05/30 16:45:21]

Will do in a follow-up.

+      'type': 'main',
+      'schema': { 'type': 'boolean' },
+      'supported_on': ['chrome.*:60-', 'chrome_os:60-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': True,
+      'id': 370,
+      'caption': '''Allow queries to a Google time service''',
+      'tags': [],
+      'desc': '''Setting this policy to false stops <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> from occasionally sending queries to a Google server to retrieve an accurate timestamp. These queries will be enabled if this policy is set to True or is not set.''',

[Thiemo Nagel, 2017/05/26 11:06:52]

Emily, could you please clarify that this does only affect Chrome the browser? 
On Chrome OS, we use tlsdated to set system time and I'm not aware of any plans
to disable that.

[estark, 2017/05/30 16:45:22]

Hmm. Just to clarify, this policy would not affect the use of tlsdated to set
the system time. If this policy were enabled on ChromeOS, if the system time did
somehow get off and the user encountered a certificate date error as a result,
the policy would use the Google time service to decide to show them a prompt to
fix the clock -- it wouldn't actually affect the system time. However, digging
through some old email, it looks like it is possible that the prompt to fix the
clock is useless/confusing on ChromeOS because it does not allow the user to
actually fix the clock. So I'll change this to non-ChromeOS.

+    },
   ],
   'messages': {
     # Messages that are not associated to any policies.