Add immutable settings checks when handling policy.

Add immutable settings checks when handling policy.

When receiving device policy from the server, make sure that the device
is an enterprise device and the policy information is meant for the user
who registered the device. While at it, move all the enterprise-related
install attributes checking to a helper.

BUG=chromium-os:14197
TEST=unit tests

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=81932

[Mattias Nissler (ping if slow), 2011-04-16 15:10:06]

This is a first stab. Feel free to take a look, I'll finalize on Monday.

[kmixter1, 2011-04-17 06:28:44]

Generally looks good to me.

On Sat, Apr 16, 2011 at 8:10 AM,  <mnissler@chromium.org> wrote:
> Reviewers: pastarmovj, kmixter1,
>
> Message:
> This is a first stab. Feel free to take a look, I'll finalize on Monday.
>
> Description:
> Add immutable settings checks when handling policy.
>
> When receiving device policy from the server, make sure that the device
> is an enterprise device and the policy information is meant for the user
> who registered the device. While at it, move all the enterprise-related
> install attributes checking to a helper.
>
> BUG=chromium-os:14197
> TEST=manual
>
>
> Please review this at http://codereview.chromium.org/6869042/
>
> SVN Base: svn://svn.chromium.org/chrome/trunk/src
>
> Affected files:
>  M chrome/browser/chromeos/cros/cryptohome_library.cc
>  M chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
>  M chrome/browser/policy/browser_policy_connector.h
>  M chrome/browser/policy/browser_policy_connector.cc
>  M chrome/browser/policy/device_policy_cache.h
>  M chrome/browser/policy/device_policy_cache.cc
>  M chrome/browser/policy/device_policy_cache_unittest.cc
>  A chrome/browser/policy/enterprise_install_attributes.h
>  A chrome/browser/policy/enterprise_install_attributes.cc
>  M chrome/browser/policy/proto/device_management_backend.proto
>  M chrome/chrome_browser.gypi
>
>
>

[pastarmovj, 2011-04-17 15:20:46]

Some minor comments for now. Will have a thorough view at it tomorrow again but
in general it looks quite good to me and thanks for adding some tests to that as
well :)

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/chromeos/logi...
File chrome/browser/chromeos/login/enterprise_enrollment_screen.cc (right):

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/chromeos/logi...
chrome/browser/chromeos/login/enterprise_enrollment_screen.cc:238: LOG(WARNING)
<< "Install Attributesj is not ready yet will retry in "
nit: s/Attributesj/Attributes/

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/policy/device...
File chrome/browser/policy/device_policy_cache.cc (right):

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/policy/device...
chrome/browser/policy/device_policy_cache.cc:121:
install_attributes_->IsEnterpriseDevice();
I can imagine this will fail most of the time until the TPM has been
initialized. It might be better to do this with in a two step. Here call the
some Tpm function like is TpmIsOwned and then post delayed task a few hundred
milliseconds later.

[Mattias Nissler (ping if slow), 2011-04-18 09:56:35]

Good to go?

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/chromeos/logi...
File chrome/browser/chromeos/login/enterprise_enrollment_screen.cc (right):

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/chromeos/logi...
chrome/browser/chromeos/login/enterprise_enrollment_screen.cc:238: LOG(WARNING)
<< "Install Attributesj is not ready yet will retry in "
On 2011/04/17 15:20:46, pastarmovj wrote:
> nit: s/Attributesj/Attributes/

Done.

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/policy/device...
File chrome/browser/policy/device_policy_cache.cc (right):

http://codereview.chromium.org/6869042/diff/2001/chrome/browser/policy/device...
chrome/browser/policy/device_policy_cache.cc:121:
install_attributes_->IsEnterpriseDevice();
On 2011/04/17 15:20:46, pastarmovj wrote:
> I can imagine this will fail most of the time until the TPM has been
> initialized. It might be better to do this with in a two step. Here call the
> some Tpm function like is TpmIsOwned and then post delayed task a few hundred
> milliseconds later.

I guess it's not worth the effort, let's just drop this line. Done.

[pastarmovj, 2011-04-18 10:03:33]

LGTM!