Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/ui/ash/chrome_shell_delegate.cc

Index: chrome/browser/ui/ash/chrome_shell_delegate.cc
diff --git a/chrome/browser/ui/ash/chrome_shell_delegate.cc b/chrome/browser/ui/ash/chrome_shell_delegate.cc
index 4ef64504769e746bff82d3001becfa416e6c0dfe..e870b83d0eb5f99f856082c3908210b4cca3025a 100644
--- a/chrome/browser/ui/ash/chrome_shell_delegate.cc
+++ b/chrome/browser/ui/ash/chrome_shell_delegate.cc
@@ -13,6 +13,7 @@
 #include "base/command_line.h"
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/app_list/app_list_service.h"
 #include "chrome/browser/ui/app_list/app_list_view_delegate.h"
@@ -29,7 +30,10 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/accessibility/accessibility_manager.h"
+#include "chrome/browser/chromeos/login/user.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #endif
 
 // static
@@ -74,6 +78,20 @@ bool ChromeShellDelegate::IsMultiProfilesEnabled() const {
   }
   if (admitted_users_to_be_added + logged_in_users <= 1)
     return false;
+
+  chromeos::User* active = chromeos::UserManager::Get()->GetActiveUser();
+  Profile* profile = NULL;
+  policy::PolicyCertService* service = NULL;
+  if (active)
+    profile = chromeos::UserManager::Get()->GetProfileByUser(active);
+  if (profile)
+    service = policy::PolicyCertServiceFactory::GetForProfile(profile);
+  if (service && (service->UsedPolicyCertificates() ||
+                  service->has_policy_certificates())) {
+    LOG(ERROR) << "Disabling multi-profiles because the current Profile is "
+               << "exposed to policy-pushed certificates.";
+    return false;
+  }
 #endif
   return true;
 }