platformKeys: Add policy and corporate key tagging.

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index cc26e75ca6777ad4a8cd073985c35a800855f6ec..730512975586b9fb7282f0387c060460cb3cc8e0 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -123,7 +123,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 301
+#   For your editing convenience: highest ID currently used: 302
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -7365,7 +7365,42 @@
       'desc': '''If this policy is set to true or not set usage of QUIC protocol in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> is allowed.
       If this policy is set to false usage of QUIC protocol is disallowed.''',
     },
+    {
+      'name': 'KeyPermissions',
+      'type': 'dict',
+      'schema': {
+        'type': 'object',
+        'additionalProperties': {
+          'type': 'object',
+          'properties': {
+            'allowCorporateKeyUsage': {
+              'description': '''If set to true, this extension can use all corporate keys to sign arbitrary data. If set to false, it cannot access any corporate key and the user can not grant such permission either.''',

[bartfab (slow), 2015/06/15 17:28:16]

1: What is a corporate key? I never heard or saw the term before in our
documentation.
2: Nit: s/key and/keys and/

[pneubeck (no reviews), 2015/06/17 08:59:56]

Changed it to "keys designated for corporate usage".
The concept of "corporate usage" is effectively introduced by this CL and means:
a key created by the enterprise.platformKeys API is by default "for corporate
usage". currently no other keys have that intended purpose. In the future, I
would like to add however the option to also mark imported keys corporate usage.
If marked that way, the admin can allow certain extensions to use these keys
through this policy. That is not possible for other types of keys nor can the
user do this for corporate keys himself.

Do you think more of this explanation should be part of the policy? Maybe it
will make more sense in an admin help document.
done.

[bartfab (slow), 2015/06/17 09:57:40]

1: I think a bit more explanation would be useful.
2: Nit: s/keys,/keys/
3: Nit: s/usage,/usage/

[pneubeck (no reviews), 2015/06/17 13:00:36]

i extended the description of the whole policy.

On 2015/06/17 09:57:40, bartfab wrote:

+              'type': 'boolean',
+            },
+          },
+        },
+      },
+      'supported_on': ['chrome_os:45-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': {
+        'extension1': {
+          'allowCorporateKeyUsage': 'true'
+        },
+        'extension2': {
+          'allowCorporateKeyUsage': 'false'
+        }
+      },
+      'id': 302,
+      'caption': 'Key Permissions',
+      'desc': '''Grants usage of private keys by extensions.
 
+      By default an extension cannot use a private key for signing data, which is equivalent to setting allowCorporateKeyUsage to false for that extension. A user cannot workaround that restriction.

[bartfab (slow), 2015/06/15 17:28:15]

Nit 1: Of course you can use "private keys" in general. You just cannot use
private keys associated with corporate key pairs.
Nit 2: s/workaround/work around/ or better, s/workaround/circumvent/

[pneubeck (no reviews), 2015/06/17 08:59:56]

Done.

+
+      Only if allowCorporateKeyUsage is set to true for an extension, it can use any private key marked for corporate usage to sign arbitrary data. This permission should only be granted if the extension is trusted to secure access to the key against attackers.''',
+    },
   ],
   'messages': {
     # Messages that are not associated to any policies.