Add a test for the "ephemeral_users_enabled" device policy

Add a test for the "ephemeral_users_enabled" device policy

This CL adds a test for the "ephemeral users enabled" policy. The
policy prevents persistent information from accumulating by mounting
cryptohome vaults via tmpfs and not writing user preferences to the
local store. Information that previously accumulated on the system is
cleared when the policy is turned on and the first user logs in.

BUG=chromium-os:27702
TEST=New PyAuto: ChromeosEphemeralUsersEnabled.* (ChromeOS)
TEST=Affected PyAutos: prefs.PrefsTest.testHaveLocalStatePrefs,
TEST=    policy.* (ChromeOS, Linux); prefs.* (ChromeOS)

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=132161

[bartfab (slow), 2012-04-10 19:54:40]

Hi Nirnimesh, now that we have a testing framework for device policies, here is
a first test that actually uses it. Could you please review?

[xot, 2012-04-11 01:42:24]

some comments and questions.

https://chromiumcodereview.appspot.com/9960074/diff/1/chrome/test/functional/...
File chrome/test/functional/chromeos_ephemeral_users_enabled.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/1/chrome/test/functional/...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:18: """Tests a policy
that makes all users except the owners ephemeral.
owner -- there can be only one.

https://chromiumcodereview.appspot.com/9960074/diff/1/chrome/test/functional/...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:126: """
I thought test images only did this when /root/forget_usernames existed.
Couldn't this file be temporarily removed for this test?

[bartfab (slow), 2012-04-11 13:44:00]

https://chromiumcodereview.appspot.com/9960074/diff/1/chrome/test/functional/...
File chrome/test/functional/chromeos_ephemeral_users_enabled.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/1/chrome/test/functional/...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:18: """Tests a policy
that makes all users except the owners ephemeral.
On 2012/04/11 01:42:24, xot wrote:
> owner -- there can be only one.

Done.

https://chromiumcodereview.appspot.com/9960074/diff/1/chrome/test/functional/...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:126: """
The root file system is normally mounted read-only but after remounting
read-write, this file can be deleted temporarily to fully test the policy. I
have updated the test accordingly.

[bartfab (slow), 2012-04-11 14:07:44]

Nirnimesh: As just pointed out to me by Mattias, it is not possible to remount /
read-write on images that have rootfs verification still enabled. Will this be
an issue for our testing infrastructure? If so, I will have to remove the parts
of the test that accumulate local state again until that /root/.forget_users
file is removed for good.

[Nirnimesh, 2012-04-12 01:15:14]

On 2012/04/11 14:07:44, bartfab wrote:
> Nirnimesh: As just pointed out to me by Mattias, it is not possible to remount
/
> read-write on images that have rootfs verification still enabled. Will this be
> an issue for our testing infrastructure? If so, I will have to remove the
parts
> of the test that accumulate local state again until that /root/.forget_users
> file is removed for good.

That's correct. You cannot rely on being able to remove /root/.forget_username
at the moment since it'll not work in the lab. Maybe to make it convenient for
Scott meanwhile, check if you can remove it, or give a warning and proceed
otherwise?

[Nirnimesh, 2012-04-12 01:17:43]

On 2012/04/12 01:15:14, Nirnimesh wrote:
> On 2012/04/11 14:07:44, bartfab wrote:
> > Nirnimesh: As just pointed out to me by Mattias, it is not possible to
remount
> /
> > read-write on images that have rootfs verification still enabled. Will this
be
> > an issue for our testing infrastructure? If so, I will have to remove the
> parts
> > of the test that accumulate local state again until that /root/.forget_users
> > file is removed for good.
> 
> That's correct. You cannot rely on being able to remove /root/.forget_username
> at the moment since it'll not work in the lab. Maybe to make it convenient for
> Scott meanwhile, check if you can remove it, or give a warning and proceed
> otherwise?

Alternatively, I'd also be fine with not automating the LocalState use cases for
now. Add appropriate TODOs, so that this can be revisited when the test image
doesn't have the .forget_usernames file anymore (it's happening this quarter).

[Nirnimesh, 2012-04-12 01:46:24]

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
File chrome/test/functional/chromeos_ephemeral_users_enabled.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:2: # Use of this
source code is governed by a BSD-style license that can be
I'd prefer a shorter filename for this test.
chromeos_ephemeral would suffice.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:12:
sys.path.append('/usr/local') # Required to import autotest libs.
nit: need at least 2 spaces before #

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:26: # The Login
browser automation call fails when the login screen is showing
Please provide a docstring.

Some of this info can go in the docstring.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:33:
owner=self._usernames[0])
it's not clear from the docstring or the method name that the owner is getting
set to user 0. Perhaps move this setUp() so that it's clearer.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:45:
self.assertTrue(actual == expected,
use assertEqual

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:95: A magic file
normally exists on test images that tells the session manager
How is this description related to --login-screen=login?

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:112:
self.set_clear_profile(False)
Why is this necessary?

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:131:
self.Login(user_index=0)
How did user 0 become the owner? from line 33?

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
File chrome/test/pyautolib/chromeos/suid_actions.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
chrome/test/pyautolib/chromeos/suid_actions.py:70: def
DisableLocalStateAutoClearing(self):
If you agree with my previous replies, these need to be removed.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
File chrome/test/pyautolib/pyauto.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
chrome/test/pyautolib/pyauto.py:1305: self._SendJSONRequest(-1,
I'm surprised that it worked with 0! Thanks for fixing.

[bartfab (slow), 2012-04-12 12:49:31]

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
File chrome/test/functional/chromeos_ephemeral_users_enabled.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:2: # Use of this
source code is governed by a BSD-style license that can be
On 2012/04/12 01:46:24, Nirnimesh wrote:
> I'd prefer a shorter filename for this test.
> chromeos_ephemeral would suffice.

Done.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:12:
sys.path.append('/usr/local') # Required to import autotest libs.
On 2012/04/12 01:46:24, Nirnimesh wrote:
> nit: need at least 2 spaces before #

Done.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:26: # The Login
browser automation call fails when the login screen is showing
On 2012/04/12 01:46:24, Nirnimesh wrote:
> Please provide a docstring.
> 
> Some of this info can go in the docstring.

Done.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:33:
owner=self._usernames[0])
It is SetDevicePolicy() that sets the owner. There is no way around dealing with
ownership information whenever device policies are being set. I renamed this
method and added a docstring explaining that it makes user 0 the owner.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:45:
self.assertTrue(actual == expected,
On 2012/04/12 01:46:24, Nirnimesh wrote:
> use assertEqual

Done.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:95: A magic file
normally exists on test images that tells the session manager
Rewritten to make it clearer.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:112:
self.set_clear_profile(False)
Added an explanation.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/function...
chrome/test/functional/chromeos_ephemeral_users_enabled.py:131:
self.Login(user_index=0)
Renamed _SetEphemeralUsersEnabled() to _SetDevicePolicyAndOwner() and added a
docstring explaining that it makes user 0 the owner.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
File chrome/test/pyautolib/chromeos/suid_actions.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
chrome/test/pyautolib/chromeos/suid_actions.py:70: def
DisableLocalStateAutoClearing(self):
To maximize test coverage, I went with the route of trying to remove the magic
file and continuing with the subset of the test still possible if this fails.

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
File chrome/test/pyautolib/pyauto.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/6001/chrome/test/pyautoli...
chrome/test/pyautolib/pyauto.py:1305: self._SendJSONRequest(-1,
It seemed to work with 0 when you are logged in. With -1, it works both when
logged in and when at the login screen.

[Nirnimesh, 2012-04-12 18:58:41]

LGTM

https://chromiumcodereview.appspot.com/9960074/diff/13003/chrome/test/functio...
File chrome/test/functional/chromeos_ephemeral.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/13003/chrome/test/functio...
chrome/test/functional/chromeos_ephemeral.py:40: return
os.path.exists(os.path.join('/home/.shadow', user_hash))
use constants.SHADOW_ROOT?

[bartfab (slow), 2012-04-13 07:54:29]

https://chromiumcodereview.appspot.com/9960074/diff/13003/chrome/test/functio...
File chrome/test/functional/chromeos_ephemeral.py (right):

https://chromiumcodereview.appspot.com/9960074/diff/13003/chrome/test/functio...
chrome/test/functional/chromeos_ephemeral.py:40: return
os.path.exists(os.path.join('/home/.shadow', user_hash))
On 2012/04/12 18:58:41, Nirnimesh wrote:
> use constants.SHADOW_ROOT?

Done.

[commit-bot: I haz the power, 2012-04-13 07:56:10]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/bartfab@chromium.org/9960074/15002

[commit-bot: I haz the power, 2012-04-13 07:56:12]

Presubmit check for 9960074-15002 failed and returned exit status 1.

Running presubmit commit checks ...

** Presubmit Warnings **
License must match:
.*? Copyright \(c\) 2012 The Chromium Authors\. All rights reserved\.\n.*? Use
of this source code is governed by a BSD-style license that can be\n.*? found in
the LICENSE file\.(?: \*/)?\n
Found a bad license header in these files:
  chrome/test/functional/chromeos_ephemeral.py

[commit-bot: I haz the power, 2012-04-13 07:58:11]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/bartfab@chromium.org/9960074/11003

[commit-bot: I haz the power, 2012-04-13 09:14:21]

Change committed as 132161