Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/chromeos/login/multi_profile_user_controller.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/multi_profile_user_controller.h"
 
 #include "base/bind.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/prefs/pref_change_registrar.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/pref_service.h"
 #include "base/prefs/scoped_user_pref_update.h"
 #include "chrome/browser/chromeos/login/multi_profile_user_controller_delegate.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/prefs/pref_service_syncable.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 
 namespace chromeos {
 
 namespace {
 
 std::string SanitizeBehaviorValue(const std::string& value) {
@@ skipping 48 matching lines @@
 
   // Always allow if there is no primary user or user being checked is the
   // primary user.
   if (primary_user_email.empty() || primary_user_email == user_email)
     return true;
 
   // Owner is not allowed to be secondary user.
   if (user_manager->GetOwnerEmail() == user_email)
     return false;
 
+  // Don't allow profiles potentially tainted by data fetched with policy-pushed
+  // certificates to join a multiprofile session.
+  if (policy::PolicyCertServiceFactory::UsedPolicyCertificates(user_email))

[Nikita (slow), 2013/12/17 18:42:05]

What if you have primary user in session that has such certificates.
Are you allowed to add other users into that session?

[Joao da Silva, 2013/12/17 20:44:21]

No, that is not allowed. That used to be handled in the chrome_shell_delegate.cc
and has been moved here.

Turns out that if this is always false (which is the case when the primary user
has certificates) then the list of allowed users is empty, which achieves the
same on the UI.

+    return false;
+
   // No user is allowed if the primary user policy forbids it.
   const std::string primary_user_behavior = GetCachedValue(primary_user_email);
   if (primary_user_behavior == kBehaviorNotAllowed)
     return false;
 
   // The user must have 'unrestricted' policy to be a secondary user.
   const std::string behavior = GetCachedValue(user_email);
   return behavior == kBehaviorUnrestricted;
 }
 
@@ skipping 59 matching lines @@
 
   PrefService* prefs = user_profile->GetPrefs();
   const std::string behavior =
       prefs->GetString(prefs::kMultiProfileUserBehavior);
   SetCachedValue(user_email, behavior);
 
   CheckSessionUsers();
 }
 
 }  // namespace chromeos