Enforce the RemoteAccessHostRequireCurtain policy on all platforms.

remoting/host/curtain_mode_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/curtain_mode.h"
 
 #include <ApplicationServices/ApplicationServices.h>
 #include <Carbon/Carbon.h>
 #include <Security/Security.h>
 #include <unistd.h>
@@ skipping 47 matching lines @@
       on_error_(on_error),
       event_handler_(NULL) {
 }
 
 CurtainModeMac::~CurtainModeMac() {
   SetActivated(false);
 }
 
 void CurtainModeMac::SetActivated(bool activated) {
   if (activated) {
-    if (!ActivateCurtain()) {
+    // If curtain mode is required, then we can't currently support remoting
+    // the login screen. This is because we don't curtain the login screen
+    // and the current daemon architecture means that the connction is closed
+    // immediately after login, leaving the host system uncurtained.
+    //
+    // TODO(jamiewalch): Fix this once we have implemented the multi-process
+    // daemon architecture (crbug.com/134894)
+    if (getuid() == 0) {

[rmsousa, 2012/11/07 00:19:16]

IIRC (Jamie might have more details) with the current implementation of Mac
curtain mode enabled we actually need to shutdown in this case - otherwise we'll
end up with two hosts running (when the curtain is activated for a host, a
second host process will get started on the login screen, and we need to
shutdown that *second* process, so it doesn't compete with the real one).

We can comment this code in its original place (based on the affected
implementation being disabled), but we can't really move it here, since (1) we
need to call HostProcess::Shutdown(), and (2) if this is the process that's
running on the login screen, we need to run this code on the process's
initialization, it has nothing to do with *this process* activating the curtain.

[Jamie, 2012/11/07 00:27:49]

Renato is correct. This is not an error activating the curtain--it's a start-up
condition that requires us to quit.

[Wez, 2012/11/07 02:37:32]

Aha; it wasn't clear to me from the comment that this is an implementation
artefact.

I've restored it to its original location and updated the comment to try to make
that clearer.

       on_error_.Run();
+      return;
     }
+
+    // Curtain-mode has issues on Mac OS X 10.7, so is currently disabled.
+    //if (!ActivateCurtain()) {
+    on_error_.Run();
+    //}
   } else {
     RemoveEventHandler();
   }
 }
 
 bool CurtainModeMac::ActivateCurtain() {
   // Try to install the switch-in handler. Do this before switching out the
   // current session so that the console session is not affected if it fails.
   if (!InstallEventHandler()) {
     return false;
@@ skipping 60 matching lines @@
 
 // static
 scoped_ptr<CurtainMode> CurtainMode::Create(
     const base::Closure& on_session_activate,
     const base::Closure& on_error) {
   return scoped_ptr<CurtainMode>(
       new CurtainModeMac(on_session_activate, on_error));
 }
 
 }  // namespace remoting