| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "chrome/browser/policy/user_cloud_policy_store.h" | |
| 6 | |
| 7 #include "base/bind.h" | |
| 8 #include "base/file_util.h" | |
| 9 #include "chrome/browser/policy/proto/cloud_policy.pb.h" | |
| 10 #include "chrome/browser/policy/proto/device_management_backend.pb.h" | |
| 11 #include "chrome/browser/policy/proto/device_management_local.pb.h" | |
| 12 #include "chrome/browser/profiles/profile.h" | |
| 13 #include "chrome/browser/signin/signin_manager.h" | |
| 14 #include "chrome/browser/signin/signin_manager_factory.h" | |
| 15 #include "content/public/browser/browser_thread.h" | |
| 16 #include "policy/policy_constants.h" | |
| 17 | |
| 18 namespace em = enterprise_management; | |
| 19 | |
| 20 namespace policy { | |
| 21 | |
| 22 enum PolicyLoadStatus { | |
| 23 // Policy blob was successfully loaded and parsed. | |
| 24 LOAD_RESULT_SUCCESS, | |
| 25 | |
| 26 // No previously stored policy was found. | |
| 27 LOAD_RESULT_NO_POLICY_FILE, | |
| 28 | |
| 29 // Could not load the previously stored policy due to either a parse or | |
| 30 // file read error. | |
| 31 LOAD_RESULT_LOAD_ERROR, | |
| 32 }; | |
| 33 | |
| 34 // Struct containing the result of a policy load - if |status| == | |
| 35 // LOAD_RESULT_SUCCESS, |policy| is initialized from the policy file on disk. | |
| 36 struct PolicyLoadResult { | |
| 37 PolicyLoadStatus status; | |
| 38 em::PolicyFetchResponse policy; | |
| 39 }; | |
| 40 | |
| 41 namespace { | |
| 42 | |
| 43 // Subdirectory in the user's profile for storing user policies. | |
| 44 const FilePath::CharType kPolicyDir[] = FILE_PATH_LITERAL("Policy"); | |
| 45 // File in the above directory for storing user policy data. | |
| 46 const FilePath::CharType kPolicyCacheFile[] = FILE_PATH_LITERAL("User Policy"); | |
| 47 | |
| 48 // Loads policy from the backing file. Returns a PolicyLoadResult with the | |
| 49 // results of the fetch. | |
| 50 policy::PolicyLoadResult LoadPolicyFromDisk(const FilePath& path) { | |
| 51 policy::PolicyLoadResult result; | |
| 52 // If the backing file does not exist, just return. | |
| 53 if (!file_util::PathExists(path)) { | |
| 54 result.status = policy::LOAD_RESULT_NO_POLICY_FILE; | |
| 55 return result; | |
| 56 } | |
| 57 std::string data; | |
| 58 if (!file_util::ReadFileToString(path, &data) || | |
| 59 !result.policy.ParseFromArray(data.c_str(), data.size())) { | |
| 60 LOG(WARNING) << "Failed to read or parse policy data from " << path.value(); | |
| 61 result.status = policy::LOAD_RESULT_LOAD_ERROR; | |
| 62 return result; | |
| 63 } | |
| 64 | |
| 65 result.status = policy::LOAD_RESULT_SUCCESS; | |
| 66 return result; | |
| 67 } | |
| 68 | |
| 69 // Stores policy to the backing file (must be called via a task on | |
| 70 // the FILE thread). | |
| 71 void StorePolicyToDiskOnFileThread(const FilePath& path, | |
| 72 const em::PolicyFetchResponse& policy) { | |
| 73 DVLOG(1) << "Storing policy to " << path.value(); | |
| 74 DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::FILE)); | |
| 75 std::string data; | |
| 76 if (!policy.SerializeToString(&data)) { | |
| 77 DLOG(WARNING) << "Failed to serialize policy data"; | |
| 78 return; | |
| 79 } | |
| 80 | |
| 81 if (!file_util::CreateDirectory(path.DirName())) { | |
| 82 DLOG(WARNING) << "Failed to create directory " << path.DirName().value(); | |
| 83 return; | |
| 84 } | |
| 85 | |
| 86 int size = data.size(); | |
| 87 if (file_util::WriteFile(path, data.c_str(), size) != size) { | |
| 88 DLOG(WARNING) << "Failed to write " << path.value(); | |
| 89 } | |
| 90 } | |
| 91 | |
| 92 } // namespace | |
| 93 | |
| 94 UserCloudPolicyStore::UserCloudPolicyStore(Profile* profile, | |
| 95 const FilePath& path) | |
| 96 : ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)), | |
| 97 profile_(profile), | |
| 98 backing_file_path_(path) { | |
| 99 } | |
| 100 | |
| 101 UserCloudPolicyStore::~UserCloudPolicyStore() {} | |
| 102 | |
| 103 // static | |
| 104 scoped_ptr<UserCloudPolicyStore> UserCloudPolicyStore::Create( | |
| 105 Profile* profile) { | |
| 106 FilePath path = | |
| 107 profile->GetPath().Append(kPolicyDir).Append(kPolicyCacheFile); | |
| 108 return make_scoped_ptr(new UserCloudPolicyStore(profile, path)); | |
| 109 } | |
| 110 | |
| 111 void UserCloudPolicyStore::LoadImmediately() { | |
| 112 DVLOG(1) << "Initiating immediate policy load from disk"; | |
| 113 // Cancel any pending Load/Store/Validate operations. | |
| 114 weak_factory_.InvalidateWeakPtrs(); | |
| 115 // Load the policy from disk... | |
| 116 PolicyLoadResult result = LoadPolicyFromDisk(backing_file_path_); | |
| 117 // ...and install it, reporting success/failure to any observers. | |
| 118 PolicyLoaded(false, result); | |
| 119 } | |
| 120 | |
| 121 void UserCloudPolicyStore::Clear() { | |
| 122 content::BrowserThread::PostTask( | |
| 123 content::BrowserThread::FILE, FROM_HERE, | |
| 124 base::Bind(base::IgnoreResult(&file_util::Delete), | |
| 125 backing_file_path_, | |
| 126 false)); | |
| 127 policy_.reset(); | |
| 128 policy_map_.Clear(); | |
| 129 NotifyStoreLoaded(); | |
| 130 } | |
| 131 | |
| 132 void UserCloudPolicyStore::Load() { | |
| 133 DVLOG(1) << "Initiating policy load from disk"; | |
| 134 // Cancel any pending Load/Store/Validate operations. | |
| 135 weak_factory_.InvalidateWeakPtrs(); | |
| 136 | |
| 137 // Start a new Load operation and have us get called back when it is | |
| 138 // complete. | |
| 139 content::BrowserThread::PostTaskAndReplyWithResult( | |
| 140 content::BrowserThread::FILE, FROM_HERE, | |
| 141 base::Bind(&LoadPolicyFromDisk, backing_file_path_), | |
| 142 base::Bind(&UserCloudPolicyStore::PolicyLoaded, | |
| 143 weak_factory_.GetWeakPtr(), true)); | |
| 144 } | |
| 145 | |
| 146 void UserCloudPolicyStore::PolicyLoaded(bool validate_in_background, | |
| 147 PolicyLoadResult result) { | |
| 148 DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI)); | |
| 149 switch (result.status) { | |
| 150 case LOAD_RESULT_LOAD_ERROR: | |
| 151 status_ = STATUS_LOAD_ERROR; | |
| 152 NotifyStoreError(); | |
| 153 break; | |
| 154 | |
| 155 case LOAD_RESULT_NO_POLICY_FILE: | |
| 156 DVLOG(1) << "No policy found on disk"; | |
| 157 NotifyStoreLoaded(); | |
| 158 break; | |
| 159 | |
| 160 case LOAD_RESULT_SUCCESS: { | |
| 161 // Found policy on disk - need to validate it before it can be used. | |
| 162 scoped_ptr<em::PolicyFetchResponse> cloud_policy( | |
| 163 new em::PolicyFetchResponse(result.policy)); | |
| 164 Validate(cloud_policy.Pass(), | |
| 165 validate_in_background, | |
| 166 base::Bind( | |
| 167 &UserCloudPolicyStore::InstallLoadedPolicyAfterValidation, | |
| 168 weak_factory_.GetWeakPtr())); | |
| 169 break; | |
| 170 } | |
| 171 default: | |
| 172 NOTREACHED(); | |
| 173 } | |
| 174 } | |
| 175 | |
| 176 void UserCloudPolicyStore::InstallLoadedPolicyAfterValidation( | |
| 177 UserCloudPolicyValidator* validator) { | |
| 178 validation_status_ = validator->status(); | |
| 179 if (!validator->success()) { | |
| 180 DVLOG(1) << "Validation failed: status=" << validation_status_; | |
| 181 status_ = STATUS_VALIDATION_ERROR; | |
| 182 NotifyStoreError(); | |
| 183 return; | |
| 184 } | |
| 185 | |
| 186 DVLOG(1) << "Validation succeeded - installing policy with dm_token: " << | |
| 187 validator->policy_data()->request_token(); | |
| 188 DVLOG(1) << "Device ID: " << validator->policy_data()->device_id(); | |
| 189 | |
| 190 InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass()); | |
| 191 FilterDisallowedPolicies(); | |
| 192 status_ = STATUS_OK; | |
| 193 NotifyStoreLoaded(); | |
| 194 } | |
| 195 | |
| 196 void UserCloudPolicyStore::Store(const em::PolicyFetchResponse& policy) { | |
| 197 // Stop any pending requests to store policy, then validate the new policy | |
| 198 // before storing it. | |
| 199 weak_factory_.InvalidateWeakPtrs(); | |
| 200 scoped_ptr<em::PolicyFetchResponse> policy_copy( | |
| 201 new em::PolicyFetchResponse(policy)); | |
| 202 Validate(policy_copy.Pass(), | |
| 203 true, | |
| 204 base::Bind(&UserCloudPolicyStore::StorePolicyAfterValidation, | |
| 205 weak_factory_.GetWeakPtr())); | |
| 206 } | |
| 207 | |
| 208 void UserCloudPolicyStore::Validate( | |
| 209 scoped_ptr<em::PolicyFetchResponse> policy, | |
| 210 bool validate_in_background, | |
| 211 const UserCloudPolicyValidator::CompletionCallback& callback) { | |
| 212 // Configure the validator. | |
| 213 scoped_ptr<UserCloudPolicyValidator> validator = | |
| 214 CreateValidator(policy.Pass()); | |
| 215 SigninManager* signin = SigninManagerFactory::GetForProfileIfExists(profile_); | |
| 216 if (signin) { | |
| 217 std::string username = signin->GetAuthenticatedUsername(); | |
| 218 DCHECK(!username.empty()); | |
| 219 validator->ValidateUsername(username); | |
| 220 } | |
| 221 | |
| 222 if (validate_in_background) { | |
| 223 // Start validation in the background. The Validator will free itself once | |
| 224 // validation is complete. | |
| 225 validator.release()->StartValidation(callback); | |
| 226 } else { | |
| 227 // Run validation immediately and invoke the callback with the results. | |
| 228 validator->RunValidation(); | |
| 229 callback.Run(validator.get()); | |
| 230 } | |
| 231 } | |
| 232 | |
| 233 void UserCloudPolicyStore::StorePolicyAfterValidation( | |
| 234 UserCloudPolicyValidator* validator) { | |
| 235 validation_status_ = validator->status(); | |
| 236 DVLOG(1) << "Policy validation complete: status = " << validation_status_; | |
| 237 if (!validator->success()) { | |
| 238 status_ = STATUS_VALIDATION_ERROR; | |
| 239 NotifyStoreError(); | |
| 240 return; | |
| 241 } | |
| 242 | |
| 243 // Persist the validated policy (just fire a task - don't bother getting a | |
| 244 // reply because we can't do anything if it fails). | |
| 245 content::BrowserThread::PostTask( | |
| 246 content::BrowserThread::FILE, FROM_HERE, | |
| 247 base::Bind(&StorePolicyToDiskOnFileThread, | |
| 248 backing_file_path_, *validator->policy())); | |
| 249 InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass()); | |
| 250 FilterDisallowedPolicies(); | |
| 251 status_ = STATUS_OK; | |
| 252 NotifyStoreLoaded(); | |
| 253 } | |
| 254 | |
| 255 void UserCloudPolicyStore::FilterDisallowedPolicies() { | |
| 256 // We don't yet allow setting SyncDisabled in desktop cloud policy, because | |
| 257 // it causes the user to be signed out which then removes the cloud policy. | |
| 258 // TODO(atwilson): Remove this once we support signing in with sync disabled | |
| 259 // (http://crbug.com/166148). | |
| 260 policy_map_.Erase(key::kSyncDisabled); | |
| 261 } | |
| 262 | |
| 263 } // namespace policy | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 12189011:
Split up chrome/browser/policy subdirectory (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src