Add a group policy controlling which sites can install extensions.

chrome/app/policy/policy_templates.json

Index: chrome/app/policy/policy_templates.json
diff --git a/chrome/app/policy/policy_templates.json b/chrome/app/policy/policy_templates.json
index ad48e2d64123a9f6b00544cc0d2151bfbceb96b0..81049b16614d420da6e2b8796ebe0eb9c7b4d1df 100644
--- a/chrome/app/policy/policy_templates.json
+++ b/chrome/app/policy/policy_templates.json
@@ -112,7 +112,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 147
+#   For your editing convenience: highest ID currently used: 148
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -1104,6 +1104,23 @@
           If this policy is left not set the user can uninstall any extension  in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.''',
           'label': '''Extension IDs and update URLs to be silently installed''',
         },
+        {
+          'name': 'ExtensionInstallSources',
+          'type': 'list',
+          'supported_on': ['chrome.*:21-', 'chrome_os:21-'],
+          'features': {'dynamic_refresh': True},
+          'example_value': ['https://corp.mycompany.com/*'],
+          'id': 148,
+          'caption': '''Configure extension, app, and user script install sources''',
+          'desc': '''Allows you to specify which URLs are allowed to install extensions, apps, and themes.
+
+          Starting in Chrome 21, extensions, apps, and user scripts can only be installed from the Chrome Web Store by default. This policy allows users to install these items from additional web pages.
+
+          Each item in this list is an extension-style match pattern (see http://code.google.com/chrome/extensions/match_patterns.html). Users will be able to install items from any URL that matches an item in this list.
+
+          ExtensionInstallBlacklist takes precedence over this policy. That is, an extension on the blacklist won't be installed, even if it happens from a site on this list.''',

[Mattias Nissler (ping if slow), 2012/06/08 09:38:22]

Please add a note on what happens if the policy is left unconfigured.

+          'label': '''URL patterns to allow extension, app, and user script installs from''',
+        },
       ],
     },
     {