Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/chromeos/login/multi_profile_user_controller.cc

Index: chrome/browser/chromeos/login/multi_profile_user_controller.cc
diff --git a/chrome/browser/chromeos/login/multi_profile_user_controller.cc b/chrome/browser/chromeos/login/multi_profile_user_controller.cc
index 1290663a44741135dd5057b4b4deb77c8507cf2b..043a0f0bfdfccd27c69b98758719d3a747151b08 100644
--- a/chrome/browser/chromeos/login/multi_profile_user_controller.cc
+++ b/chrome/browser/chromeos/login/multi_profile_user_controller.cc
@@ -11,7 +11,10 @@
 #include "base/prefs/pref_service.h"
 #include "base/prefs/scoped_user_pref_update.h"
 #include "chrome/browser/chromeos/login/multi_profile_user_controller_delegate.h"
+#include "chrome/browser/chromeos/login/user.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/prefs/pref_service_syncable.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
@@ -80,6 +83,23 @@ bool MultiProfileUserController::IsUserAllowedInSession(
   if (user_manager->GetOwnerEmail() == user_email)
     return false;
 
+  // Don't allow profiles potentially tainted by data fetched with policy-pushed
+  // certificates to join a multiprofile session.
+  if (policy::PolicyCertServiceFactory::UsedPolicyCertificates(user_email))
+    return false;
+
+  // Don't allow any secondary profiles if the primary profile is potentially
+  // tainted.
+  const User* primary_user = user_manager->GetPrimaryUser();
+  Profile* profile =
+      primary_user ? user_manager->GetProfileByUser(primary_user) : NULL;
+  policy::PolicyCertService* service =
+      profile ? policy::PolicyCertServiceFactory::GetForProfile(profile) : NULL;
+  if (service && (service->UsedPolicyCertificates() ||
+                  service->has_policy_certificates())) {
+    return false;
+  }
+
   // No user is allowed if the primary user policy forbids it.
   const std::string primary_user_behavior = GetCachedValue(primary_user_email);
   if (primary_user_behavior == kBehaviorNotAllowed)
@@ -107,11 +127,12 @@ void MultiProfileUserController::StartObserving(Profile* user_profile) {
   OnUserPrefChanged(user_profile);
 }
 
-void MultiProfileUserController::RemoveCachedValue(
+void MultiProfileUserController::RemoveCachedValues(
     const std::string& user_email) {
   DictionaryPrefUpdate update(local_state_,
                               prefs::kCachedMultiProfileUserBehavior);
   update->RemoveWithoutPathExpansion(user_email, NULL);
+  policy::PolicyCertServiceFactory::ClearUsedPolicyCertificates(user_email);

[pneubeck (no reviews), 2013/12/18 09:11:07]

i think the old place was better for this as the tainting information is used by
multiprofile, but doesn't depend on it.

[Joao da Silva, 2013/12/18 09:40:13]

I'd prefer to have this next to the code that calls the Set() (which is
PolicyCertService), but its profile does not exist when the user is deleted. So
it has to be in UserManagerImpl or in one of the methods that it calls; since
the test logic is here and there's also cleanup logic in this class then I think
this is the least bad place.

 }
 
 std::string MultiProfileUserController::GetCachedValue(