Update policy signature verification to include policy domain.

chrome/browser/chromeos/settings/session_manager_operation.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/files/file_path.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 164 matching lines @@
   // To prevent all of these issues the timestamp is just not verified when
   // loading the device policy from the cache. Note that the timestamp is still
   // verified during enrollment and when a new policy is fetched from the
   // server.
   validator->ValidateAgainstCurrentPolicy(
       policy_data_.get(),
       policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
   validator->ValidatePayload();
+  // We don't check the DMServer verification key below, because the signing
+  // key is validated when it is installed.

[palmer, 2014/02/14 21:52:48]

What is the harm of checking it again?

[Andrew T Wilson (Slow), 2014/02/17 17:28:40]

None, really - I've also spoken with mnissler about this. The problem is that
there are cases where this data is signed with the owners key for the device
(see the comment above about "policy auto-generated by session manager" - not
downloaded/signed by DMServer), and this owners key is not currently signed with
a verification key. Before we can start checking owner key verification
signatures, we need some way to migrate all of the existing devices to *have*
owner key verification signatures, which is an issue we're punting on now since
the verification signature is currently only critical for desktop.

I have crbug.com/328038 open to track this (and other) cros key verification
signature issues.

   validator->ValidateSignature(owner_key_->public_key_as_string(),
-                               policy::GetPolicyVerificationKey(),
+                               std::string(),  // No key validation check.
                                std::string(),
                                false);
   validator->StartValidation(
       base::Bind(&SessionManagerOperation::ReportValidatorStatus,
                  weak_factory_.GetWeakPtr()));
 }
 
 void SessionManagerOperation::ReportValidatorStatus(
     policy::DeviceCloudPolicyValidator* validator) {
   DeviceSettingsService::Status status =
@@ skipping 131 matching lines @@
 }
 
 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
   if (!success)
     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
   else
     StartLoading();
 }
 
 }  // namespace chromeos