Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/ui/ash/chrome_shell_delegate.cc

Index: chrome/browser/ui/ash/chrome_shell_delegate.cc
diff --git a/chrome/browser/ui/ash/chrome_shell_delegate.cc b/chrome/browser/ui/ash/chrome_shell_delegate.cc
index 4ef64504769e746bff82d3001becfa416e6c0dfe..e870b83d0eb5f99f856082c3908210b4cca3025a 100644
--- a/chrome/browser/ui/ash/chrome_shell_delegate.cc
+++ b/chrome/browser/ui/ash/chrome_shell_delegate.cc
@@ -13,6 +13,7 @@
 #include "base/command_line.h"
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/app_list/app_list_service.h"
 #include "chrome/browser/ui/app_list/app_list_view_delegate.h"
@@ -29,7 +30,10 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/accessibility/accessibility_manager.h"
+#include "chrome/browser/chromeos/login/user.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #endif
 
 // static
@@ -74,6 +78,20 @@ bool ChromeShellDelegate::IsMultiProfilesEnabled() const {
   }
   if (admitted_users_to_be_added + logged_in_users <= 1)
     return false;
+
+  chromeos::User* active = chromeos::UserManager::Get()->GetActiveUser();

[James Cook, 2013/12/17 17:19:46]

A few questions:
* Is there someplace else this blob of code could live to avoid adding extra
dependencies to this file (especially Profile)?  Maybe in the policy code
somewhere?
* Is it ever the case that there is no active user?
* Is it ever the case that the active user has no profile?

[Mr4D (OOO till 08-26), 2013/12/17 17:39:35]

Would it be possible to move this into the UserManager? There are already
several policy checks performed - and even more so
"GetUsersAdmittedForMultiProfile" should do the same test...

As such adding there a function like "IsUserAllowedForMultiProfile" should be
easy.

[Joao da Silva, 2013/12/17 20:44:21]

IsUserAllowedInSession can also have this logic, and indeed seems like a better
fix. This file doesn't have changes anymore.
Before the first user signs in.
Not really, just being defensive :-)

[Joao da Silva, 2013/12/17 20:44:21]

Moved to MultiProfileUserController::IsUserAllowedInSession. That class handles
logic related to multiprofiles, and that method is already performing similar
checks.

+  Profile* profile = NULL;
+  policy::PolicyCertService* service = NULL;
+  if (active)
+    profile = chromeos::UserManager::Get()->GetProfileByUser(active);
+  if (profile)
+    service = policy::PolicyCertServiceFactory::GetForProfile(profile);
+  if (service && (service->UsedPolicyCertificates() ||
+                  service->has_policy_certificates())) {
+    LOG(ERROR) << "Disabling multi-profiles because the current Profile is "
+               << "exposed to policy-pushed certificates.";
+    return false;
+  }
 #endif
   return true;
 }