Update policy signature verification to include policy domain.

chrome/browser/chromeos/settings/session_manager_operation.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/files/file_path.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 164 matching lines @@
   // To prevent all of these issues the timestamp is just not verified when
   // loading the device policy from the cache. Note that the timestamp is still
   // verified during enrollment and when a new policy is fetched from the
   // server.
   validator->ValidateAgainstCurrentPolicy(
       policy_data_.get(),
       policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
   validator->ValidatePayload();
+  // We don't check the DMServer verification key below, because policy blobs
+  // generated by session manager aren't signed by DMServer.

[Mattias Nissler (ping if slow), 2014/02/13 10:52:53]

technically, policy blobs _are_ signed. We don't check the certificate for the
signing key though, and the reason for that is that we've done these validations
when installing a new key.

[Andrew T Wilson (Slow), 2014/02/13 12:15:36]

They are signed, but not signed by DMServer, right? Anyhow, I updated this
comment to be more agnostic about who signs it and to reflect your feedback.

[Mattias Nissler (ping if slow), 2014/02/13 13:35:55]

They are signed by DMServer. We just store the PolicyFetchResponse received from
the server.

   validator->ValidateSignature(owner_key_->public_key_as_string(),
-                               policy::GetPolicyVerificationKey(),
+                               std::string(),
                                std::string(),
                                false);
   validator->StartValidation(
       base::Bind(&SessionManagerOperation::ReportValidatorStatus,
                  weak_factory_.GetWeakPtr()));
 }
 
 void SessionManagerOperation::ReportValidatorStatus(
     policy::DeviceCloudPolicyValidator* validator) {
   DeviceSettingsService::Status status =
@@ skipping 131 matching lines @@
 }
 
 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
   if (!success)
     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
   else
     StartLoading();
 }
 
 }  // namespace chromeos