Update policy signature verification to include policy domain.

chrome/browser/chromeos/settings/session_manager_operation.cc

Index: chrome/browser/chromeos/settings/session_manager_operation.cc
diff --git a/chrome/browser/chromeos/settings/session_manager_operation.cc b/chrome/browser/chromeos/settings/session_manager_operation.cc
index d7f994c83f80f52730311eb322fb77ed8f20f761..74efda9fe47dafdd00e90f4d6dd98202462cc565 100644
--- a/chrome/browser/chromeos/settings/session_manager_operation.cc
+++ b/chrome/browser/chromeos/settings/session_manager_operation.cc
@@ -182,8 +182,10 @@ void SessionManagerOperation::ValidateDeviceSettings(
       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
   validator->ValidatePayload();
+  // We don't check the DMServer verification key below, because the signing
+  // key is validated when it is installed.

[palmer, 2014/02/14 21:52:48]

What is the harm of checking it again?

[Andrew T Wilson (Slow), 2014/02/17 17:28:40]

None, really - I've also spoken with mnissler about this. The problem is that
there are cases where this data is signed with the owners key for the device
(see the comment above about "policy auto-generated by session manager" - not
downloaded/signed by DMServer), and this owners key is not currently signed with
a verification key. Before we can start checking owner key verification
signatures, we need some way to migrate all of the existing devices to *have*
owner key verification signatures, which is an issue we're punting on now since
the verification signature is currently only critical for desktop.

I have crbug.com/328038 open to track this (and other) cros key verification
signature issues.

   validator->ValidateSignature(owner_key_->public_key_as_string(),
-                               policy::GetPolicyVerificationKey(),
+                               std::string(),  // No key validation check.
                                std::string(),
                                false);
   validator->StartValidation(