Verify the signature on user cloud policy downloads.

chrome/browser/policy/browser_policy_connector.cc

Index: chrome/browser/policy/browser_policy_connector.cc
diff --git a/chrome/browser/policy/browser_policy_connector.cc b/chrome/browser/policy/browser_policy_connector.cc
index 8b30543c14c0fc1b769c2721282c3e8e4c6c1892..7792d38ccdd49a129c7f3e814738f1c8270cabf2 100644
--- a/chrome/browser/policy/browser_policy_connector.cc
+++ b/chrome/browser/policy/browser_policy_connector.cc
@@ -7,7 +7,6 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
-#include "base/file_path.h"
 #include "base/message_loop.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
@@ -77,6 +76,10 @@ const FilePath::CharType kPolicyDir[] = FILE_PATH_LITERAL("Device Management");
 const FilePath::CharType kTokenCacheFile[] = FILE_PATH_LITERAL("Token");
 // File in the above directory for storing user policy data.
 const FilePath::CharType kPolicyCacheFile[] = FILE_PATH_LITERAL("Policy");
+// Path that contains the user policy keys after the user's vault is mounted.
+// This is appended to |g_root_path|.
+const FilePath::CharType kUserPolicyKeyDir[] =
+    FILE_PATH_LITERAL("var/run/user_policy");
 
 // The following constants define delays applied before the initial policy fetch
 // on startup. (So that displaying Chrome's GUI does not get delayed.)
@@ -93,6 +96,9 @@ const char kDefaultDeviceManagementServerUrl[] =
 // Used in BrowserPolicyConnector::SetPolicyProviderForTesting.
 ConfigurationPolicyProvider* g_testing_provider = NULL;
 
+// Used in BrowserPolicyConnector::SetRootPathForTesting.
+const FilePath::CharType* g_root_path = FILE_PATH_LITERAL("/");
+
 }  // namespace
 
 BrowserPolicyConnector::BrowserPolicyConnector()
@@ -255,6 +261,8 @@ void BrowserPolicyConnector::InitializeUserPolicy(
   const FilePath policy_dir = profile_dir.Append(kPolicyDir);
   const FilePath policy_cache_file = policy_dir.Append(kPolicyCacheFile);
   const FilePath token_cache_file = policy_dir.Append(kTokenCacheFile);
+  const FilePath root_path(g_root_path);
+  const FilePath policy_key_dir(root_path.Append(kUserPolicyKeyDir));
 
   if (wait_for_policy_fetch)
     device_management_service_->ScheduleInitialization(0);
@@ -269,8 +277,9 @@ void BrowserPolicyConnector::InitializeUserPolicy(
   } else if (!IsNonEnterpriseUser(user_name)) {
     scoped_ptr<CloudPolicyStore> store(
         new UserCloudPolicyStoreChromeOS(
+            chromeos::DBusThreadManager::Get()->GetCryptohomeClient(),
             chromeos::DBusThreadManager::Get()->GetSessionManagerClient(),
-            user_name, token_cache_file, policy_cache_file));
+            user_name, policy_key_dir, token_cache_file, policy_cache_file));
     user_cloud_policy_manager_.reset(
         new UserCloudPolicyManagerChromeOS(store.Pass(),
                                            wait_for_policy_fetch));
@@ -330,6 +339,12 @@ NetworkConfigurationUpdater*
 }
 #endif
 
+// static
+void BrowserPolicyConnector::SetRootPathForTesting(
+    const FilePath::CharType* root_path) {
+  g_root_path = root_path;
+}
+
 void BrowserPolicyConnector::SetDeviceManagementServiceForTesting(
     scoped_ptr<DeviceManagementService> service) {
   device_management_service_ = service.Pass();