Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/multi_profile_user_controller.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/chromeos/login/fake_user_manager.h"
 #include "chrome/browser/chromeos/login/multi_profile_user_controller_delegate.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/scoped_testing_local_state.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/testing_pref_service_syncable.h"
 #include "chrome/test/base/testing_profile.h"
 #include "chrome/test/base/testing_profile_manager.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace chromeos {
@@ skipping 234 matching lines @@
   LoginUser(0);
   SetOwner(1);
 
   EXPECT_FALSE(controller()->IsUserAllowedInSession(kUsers[1]));
 
   EXPECT_EQ(0, user_not_allowed_count());
   LoginUser(1);
   EXPECT_EQ(1, user_not_allowed_count());
 }
 
+TEST_F(MultiProfileUserControllerTest,
+       UsedPolicyCertificatesAllowedForPrimary) {
+  policy::PolicyCertServiceFactory::SetUsedPolicyCertificates(kUsers[0]);
+  EXPECT_TRUE(controller()->IsUserAllowedInSession(kUsers[0]));
+  EXPECT_TRUE(controller()->IsUserAllowedInSession(kUsers[1]));

[Nikita (slow), 2013/12/17 18:42:05]

nit: It seems that you're actually checking both users here and they are both
allowed?

[Joao da Silva, 2013/12/17 20:44:21]

Yes; this test verifies that both "normal" and "tainted" users can become the
primary user. Note that none of them have logged in yet.

+  policy::PolicyCertServiceFactory::ClearUsedPolicyCertificates(kUsers[0]);
+}
+
+TEST_F(MultiProfileUserControllerTest,
+       UsedPolicyCertificatesDisallowedForSecondary) {
+  LoginUser(1);
+  EXPECT_TRUE(controller()->IsUserAllowedInSession(kUsers[0]));
+  policy::PolicyCertServiceFactory::SetUsedPolicyCertificates(kUsers[0]);
+  EXPECT_FALSE(controller()->IsUserAllowedInSession(kUsers[0]));
+  policy::PolicyCertServiceFactory::ClearUsedPolicyCertificates(kUsers[0]);
+}
+
 }  // namespace chromeos