Update policy signature verification to include policy domain.

chrome/browser/chromeos/settings/session_manager_operation.cc

Index: chrome/browser/chromeos/settings/session_manager_operation.cc
diff --git a/chrome/browser/chromeos/settings/session_manager_operation.cc b/chrome/browser/chromeos/settings/session_manager_operation.cc
index d7f994c83f80f52730311eb322fb77ed8f20f761..ebaecf367d0198faa2c9d03013dcba01a5067013 100644
--- a/chrome/browser/chromeos/settings/session_manager_operation.cc
+++ b/chrome/browser/chromeos/settings/session_manager_operation.cc
@@ -182,8 +182,10 @@ void SessionManagerOperation::ValidateDeviceSettings(
       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
   validator->ValidatePayload();
+  // We don't check the DMServer verification key below, because policy blobs
+  // generated by session manager aren't signed by DMServer.

[Mattias Nissler (ping if slow), 2014/02/13 10:52:53]

technically, policy blobs _are_ signed. We don't check the certificate for the
signing key though, and the reason for that is that we've done these validations
when installing a new key.

[Andrew T Wilson (Slow), 2014/02/13 12:15:36]

They are signed, but not signed by DMServer, right? Anyhow, I updated this
comment to be more agnostic about who signs it and to reflect your feedback.

[Mattias Nissler (ping if slow), 2014/02/13 13:35:55]

They are signed by DMServer. We just store the PolicyFetchResponse received from
the server.

   validator->ValidateSignature(owner_key_->public_key_as_string(),
-                               policy::GetPolicyVerificationKey(),
+                               std::string(),
                                std::string(),
                                false);
   validator->StartValidation(