Enforce the RemoteAccessHostRequireCurtain policy on all platforms.

remoting/host/remoting_me2me_host.cc

Index: remoting/host/remoting_me2me_host.cc
diff --git a/remoting/host/remoting_me2me_host.cc b/remoting/host/remoting_me2me_host.cc
index cdf6962b31ee2a892356f655cbb26b9d5e502811..ad8500a921a8c1f359cd2ac8f1ab842a8a5fd2cf 100644
--- a/remoting/host/remoting_me2me_host.cc
+++ b/remoting/host/remoting_me2me_host.cc
@@ -243,6 +243,7 @@ class HostProcess
 
   scoped_ptr<CurtainMode> curtain_;
   scoped_ptr<CurtainingHostObserver> curtaining_host_observer_;
+  bool curtain_required_;
 
   bool restarting_;
   bool shutting_down_;
@@ -270,6 +271,7 @@ class HostProcess
 HostProcess::HostProcess(scoped_ptr<ChromotingHostContext> context)
     : context_(context.Pass()),
       allow_nat_traversal_(true),
+      curtain_required_(false),
       restarting_(false),
       shutting_down_(false),
       desktop_resizer_(DesktopResizer::Create()),
@@ -710,24 +712,10 @@ bool HostProcess::OnCurtainPolicyUpdate(bool curtain_required) {
   // Returns true if the host has to be restarted after this policy update.
   DCHECK(context_->network_task_runner()->BelongsToCurrentThread());
 
-#if defined(OS_MACOSX)
-  if (curtain_required) {
-    // If curtain mode is required, then we can't currently support remoting
-    // the login screen. This is because we don't curtain the login screen
-    // and the current daemon architecture means that the connction is closed
-    // immediately after login, leaving the host system uncurtained.
-    //
-    // TODO(jamiewalch): Fix this once we have implemented the multi-process
-    // daemon architecture (crbug.com/134894)
-    if (getuid() == 0) {
-      Shutdown(kLoginScreenNotSupportedExitCode);
-      return false;
-    }
-  }
-#endif
-  if (curtain_->required() != curtain_required) {
+  if (curtain_required_ != curtain_required) {
+    curtain_required_ = curtain_required;
     LOG(INFO) << "Updated curtain policy.";

[Jamie, 2012/11/07 00:27:49]

While you're here, it would be useful to log the new value.

[Wez, 2012/11/07 02:37:32]

I'll be following up shortly to add an ignore-policies policy, so I'll add
printout of policy values there.

[Wez, 2012/11/07 02:37:32]

I've update the logging of all the policy values, rather than single this one
out for special treatment.

-    curtain_->set_required(curtain_required);
+    curtaining_host_observer_->SetEnableCurtaining(curtain_required_);

[rmsousa, 2012/11/07 00:19:16]

Note that the RestartHost immediately after this will kick out all the remote
clients. So doing this immediately here and also curtaining the local console
seems a bit redundant.

[Wez, 2012/11/07 02:37:32]

It'll curtain the local console iff there's a connection active to it, which is
correct wrt the intent of the policy.

     return true;
   }
   return false;
@@ -815,10 +803,10 @@ void HostProcess::StartHost() {
       new ResizingHostObserver(desktop_resizer_.get(), host_));
 #endif
 
-  // Curtain mode is currently broken on Mac (the only supported platform),
-  // so it's disabled until we've had time to fully investigate.
-  //    curtaining_host_observer_.reset(new CurtainingHostObserver(
-  //          curtain_.get(), host_));
+  // Create a host observer to enable/disable curtain mode as clients connect
+  // and disconnect.
+  curtaining_host_observer_.reset(new CurtainingHostObserver(

[rmsousa, 2012/11/07 00:19:16]

You need to SetEnableCurtaining again in the new object.

[Wez, 2012/11/07 02:37:32]

Done.

+                                  curtain_.get(), host_));
 
   if (host_user_interface_.get()) {
     host_user_interface_->Start(