entd: Add policy signatures

entd: Add policy signatures

This is a first pass at signed enterprise policies.  A single script is provided that can sign policies and verify signatures.  Another CL will use this script to start the enterprise daemon after verifying the signature.

In the future the signature verification should be baked directly into entd.

entdwife.sh: initial add of utility script to sign and verify policies.
main.cc: check for root-cert.pem, root_cert.pem as a backup.
fix_pkcs11_token.sh: add lcense header.
add trailing / to 127.0.0.1 permission check.

BUG=chromium-os:4621
TEST=gmerge onto device and test with signed and unsigned policies

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=7b26ac5

[rginda, 2010-10-04 18:41:13]

http://codereview.chromium.org/3541011/diff/1/2
File base_policy/policy-utils.js (right):

http://codereview.chromium.org/3541011/diff/1/2#newcode55
base_policy/policy-utils.js:55: if (perms.length != 1 ||
perms[0].indexOf("http://127.0.0.1/") != 0)
This unrelated change ensures that the policy doesn't ask for "127.0.0.10/", or
something else we didn't really expect.

http://codereview.chromium.org/3541011/diff/1/5
File main.cc (left):

http://codereview.chromium.org/3541011/diff/1/5#oldcode160
main.cc:160: path = FilePath(extension_path).Append("root_ca.pem");
Another unrelated change to standardize on "-" rather than "_" in filenames
included in the extension.

[Chris Masone, 2010-10-04 20:39:48]

http://codereview.chromium.org/3541011/diff/1/3
File bin/entdwife.sh (right):

http://codereview.chromium.org/3541011/diff/1/3#newcode28
bin/entdwife.sh:28: "Verify the authenticity of the signature" "C"
Why not "v" or "V"?

http://codereview.chromium.org/3541011/diff/1/3#newcode76
bin/entdwife.sh:76: # Sign an extension.
comment is stale

http://codereview.chromium.org/3541011/diff/1/3#newcode123
bin/entdwife.sh:123: log "Unable to locate google-chrome executable"
Is this meant for use on the device?  Because we don't call it google-chrome....

http://codereview.chromium.org/3541011/diff/1/3#newcode165
bin/entdwife.sh:165: #rm -rf "$workdir"
either do this or delete it.

http://codereview.chromium.org/3541011/diff/1/3#newcode387
bin/entdwife.sh:387: if [ ! -z "$(echo "$output" | grep "error")" ]; then
perhaps a comment to explain why you're grepping output to determine what
happened.

http://codereview.chromium.org/3541011/diff/1/3#newcode409
bin/entdwife.sh:409: # Declare $output before assigning, so we don't lose the
return code of
shouldn't this be down lower?

http://codereview.chromium.org/3541011/diff/1/3#newcode435
bin/entdwife.sh:435: #rm "$catfile" "$keyfile"
toss this line?

[rginda, 2010-10-04 20:56:04]

PTAL

http://codereview.chromium.org/3541011/diff/1/3
File bin/entdwife.sh (right):

http://codereview.chromium.org/3541011/diff/1/3#newcode28
bin/entdwife.sh:28: "Verify the authenticity of the signature" "C"
On 2010/10/04 20:39:48, Chris Masone wrote:
> Why not "v" or "V"?

Done.

http://codereview.chromium.org/3541011/diff/1/3#newcode76
bin/entdwife.sh:76: # Sign an extension.
On 2010/10/04 20:39:48, Chris Masone wrote:
> comment is stale

That whole condition was stale, removed.

http://codereview.chromium.org/3541011/diff/1/3#newcode123
bin/entdwife.sh:123: log "Unable to locate google-chrome executable"
On 2010/10/04 20:39:48, Chris Masone wrote:
> Is this meant for use on the device?  Because we don't call it
google-chrome....

No, this routine makes a crx file, which is something we don't expect to do on
the device.

http://codereview.chromium.org/3541011/diff/1/3#newcode165
bin/entdwife.sh:165: #rm -rf "$workdir"
On 2010/10/04 20:39:48, Chris Masone wrote:
> either do this or delete it.

Done.

http://codereview.chromium.org/3541011/diff/1/3#newcode387
bin/entdwife.sh:387: if [ ! -z "$(echo "$output" | grep "error")" ]; then
On 2010/10/04 20:39:48, Chris Masone wrote:
> perhaps a comment to explain why you're grepping output to determine what
> happened.

Done.

http://codereview.chromium.org/3541011/diff/1/3#newcode409
bin/entdwife.sh:409: # Declare $output before assigning, so we don't lose the
return code of
On 2010/10/04 20:39:48, Chris Masone wrote:
> shouldn't this be down lower?

Done.

http://codereview.chromium.org/3541011/diff/1/3#newcode435
bin/entdwife.sh:435: #rm "$catfile" "$keyfile"
On 2010/10/04 20:39:48, Chris Masone wrote:
> toss this line?
> 

Done.

[Chris Masone, 2010-10-04 22:19:15]

lgtm