Make curtain-mode controllable by policy.

remoting/host/remoting_me2me_host.cc

Index: remoting/host/remoting_me2me_host.cc
diff --git a/remoting/host/remoting_me2me_host.cc b/remoting/host/remoting_me2me_host.cc
index e9e473206e846a4edf92ea2574c33f40c2258408..e903662f42f25db217ce4cedfd441e5539d8e6a8 100644
--- a/remoting/host/remoting_me2me_host.cc
+++ b/remoting/host/remoting_me2me_host.cc
@@ -50,6 +50,7 @@
 #include "remoting/protocol/me2me_host_authenticator_factory.h"
 
 #if defined(OS_MACOSX)
+#include "base/mac/scoped_cftyperef.h"
 #include "base/mac/scoped_nsautorelease_pool.h"
 #include "remoting/host/curtain_mode_mac.h"
 #include "remoting/host/sighup_listener_mac.h"
@@ -103,7 +104,14 @@ class HostProcess
         allow_nat_traversal_(true),
         restarting_(false),
         shutting_down_(false),
-        exit_code_(kSuccessExitCode) {
+        exit_code_(kSuccessExitCode)
+#if defined(OS_MACOSX)
+      , curtain_(base::Bind(&HostProcess::OnDisconnectRequested,
+                            base::Unretained(this)),
+                 base::Bind(&HostProcess::OnDisconnectRequested,
+                            base::Unretained(this)))
+#endif
+  {
     context_.reset(
         new ChromotingHostContext(message_loop_.message_loop_proxy()));
     context_->Start();
@@ -319,6 +327,10 @@ class HostProcess
       return;
     }
 
+    if (!host_) {
+      StartHost();
+    }
+
     bool bool_value;
     std::string string_value;
     if (policies->GetString(policy_hack::PolicyWatcher::kHostDomainPolicyName,
@@ -329,6 +341,11 @@ class HostProcess
                              &bool_value)) {
       OnNatPolicyUpdate(bool_value);
     }
+    if (policies->GetBoolean(
+            policy_hack::PolicyWatcher::kHostRequireCurtainPolicyName,
+            &bool_value)) {
+      OnCurtainPolicyUpdate(bool_value);
+    }
   }
 
   void OnHostDomainPolicyUpdate(const std::string& host_domain) {
@@ -356,15 +373,44 @@ class HostProcess
     bool policy_changed = allow_nat_traversal_ != nat_traversal_enabled;
     allow_nat_traversal_ = nat_traversal_enabled;
 
-    if (host_) {
-      // Restart the host if the policy has changed while the host was
-      // online.
-      if (policy_changed)
-        RestartHost();
+    if (policy_changed) {
+      RestartHost();
+    }
+  }
+
+  void OnCurtainPolicyUpdate(bool curtain_required) {
+#if defined(OS_MACOSX)
+    if (!context_->network_task_runner()->BelongsToCurrentThread()) {
+      context_->network_task_runner()->PostTask(FROM_HERE, base::Bind(
+          &HostProcess::OnCurtainPolicyUpdate, base::Unretained(this),
+          curtain_required));
+      return;
+    }
+
+    if (curtain_required) {
+      // If curtain mode is required, then we can't currently support remoting
+      // the login screen. This is because the current daemon architecture means
+      // that the remote user is disconnected immediately after login, leaving
+      // the host system uncurtained.

[Lambros, 2012/08/14 20:21:06]

I don't understand this.  Why does disconnection immediately after login leave
the host system uncurtained?  Why is this different from any other
disconnection?  Wouldn't disconnection from a desktop session also leave the
host system uncurtained?  Why is this a problem for the login screen but not for
a desktop session?

Anyway, it's not clear that our curtain implementation even works on the login
screen.  We fast-switch the display from the login screen to, what, the login
screen?

And even if uncurtaining on disconnection were a problem, couldn't we mitigate
this by activating the screen-lock?

[Jamie, 2012/08/14 22:04:22]

If you connect while at the login screen, we don't curtain. If you log in, you
are then disconnected because of the way we integrate with launchd. At that
point, the physical display is showing (or will very soon show) your uncurtained
desktop. Once you connect again, it will be curtained, but there's a window of
opportunity for someone at the host system to be naughty.

[Lambros, 2012/08/14 23:28:50]

OK I get it now :)  The missing piece here is that our implementation of
curtain-mode does not work on the login screen, and so we don't do it.  (A
different implementation of curtain-mode would not have this problem.)  Please
can you rephrase the explanation to add this detail?

[Jamie, 2012/08/15 18:22:56]

Done.

+      //
+      // TODO(jamiewalch): Fix this once we have implemented the multi-process
+      // daemon architecture

[garykac, 2012/08/14 19:58:48]

Is there a bug tracking the multi-proc daemon work?

[Jamie, 2012/08/15 18:22:56]

Yes. I've added a reference to it here.

+      base::mac::ScopedCFTypeRef<CFDictionaryRef> session(
+          CGSessionCopyCurrentDictionary());
+      const void* logged_in = CFDictionaryGetValue(session,
+                                                   kCGSessionLoginDoneKey);
+      if (logged_in != kCFBooleanTrue) {
+        Shutdown(kLoginScreenNotSupportedExitCode);
+        return;
+      }
+
+      host_->AddStatusObserver(&curtain_);
+      curtain_.SetEnabled(true);
     } else {
-      // Just start the host otherwise.
-      StartHost();
+      curtain_.SetEnabled(false);
+      host_->RemoveStatusObserver(&curtain_);
     }
+#endif
   }
 
   void StartHost() {
@@ -447,12 +493,6 @@ class HostProcess
                           base::Unretained(this)));
 #endif
 
-#if defined(OS_MACOSX)
-    curtain_.Init(base::Bind(&HostProcess::OnDisconnectRequested,
-                             base::Unretained(this)));
-    host_->AddStatusObserver(&curtain_);
-#endif
-
     host_->Start();
 
     CreateAuthenticatorFactory();