Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/ui/ash/chrome_shell_delegate.cc

Index: chrome/browser/ui/ash/chrome_shell_delegate.cc
diff --git a/chrome/browser/ui/ash/chrome_shell_delegate.cc b/chrome/browser/ui/ash/chrome_shell_delegate.cc
index 4ef64504769e746bff82d3001becfa416e6c0dfe..9eb41185da6f1408ba08e98dafe4487501992d7c 100644
--- a/chrome/browser/ui/ash/chrome_shell_delegate.cc
+++ b/chrome/browser/ui/ash/chrome_shell_delegate.cc
@@ -13,6 +13,7 @@
 #include "base/command_line.h"
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/app_list/app_list_service.h"
 #include "chrome/browser/ui/app_list/app_list_view_delegate.h"
@@ -29,7 +30,10 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/accessibility/accessibility_manager.h"
+#include "chrome/browser/chromeos/login/user.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #endif
 
 // static
@@ -74,6 +78,19 @@ bool ChromeShellDelegate::IsMultiProfilesEnabled() const {
   }
   if (admitted_users_to_be_added + logged_in_users <= 1)
     return false;
+
+  chromeos::User* active = chromeos::UserManager::Get()->GetActiveUser();
+  Profile* profile = NULL;
+  policy::PolicyCertService* service = NULL;
+  if (active)

[pneubeck (no reviews), 2013/12/17 15:25:31]

are !active
and !profile
errors? DCHECK/LOG?

[Joao da Silva, 2013/12/17 16:36:41]

!active means that no-one is signed in yet, so it's fine.

active && !profile should not happen; GetProfileByUser triggers a DCHECK (at
ProfileManager) if that happens.

+    profile = chromeos::UserManager::Get()->GetProfileByUser(active);
+  if (profile)
+    service = policy::PolicyCertServiceFactory::GetForProfile(profile);
+  if (service && service->IsTainted()) {
+    LOG(ERROR) << "Disabling multi-profiles because the current Profile is "
+               << "exposed to policy-pushed certificates.";
+    return false;
+  }
 #endif
   return true;
 }