Add usb_detachable_whitelist to device policy proto

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 8160 matching lines @@
       after the policy value has changed. Users may change the display
       rotation via the settings page after logging in, but their
       setting will be overridden by the policy value at the next reboot.
 
       This policy applies to both the primary and all secondary displays.
 
       If the policy is not set, the default value is 0 degrees and the user is
       free to change it. In this case, the default value is not reapplied at
       restart.''',
     },
+    {
+      'name': 'UsbDetachableWhitelist',
+      'type': 'list',
+      'schema': {
+        'type': 'array',
+        'items': {
+          'type': 'object',
+          'id': 'UsbDeviceId',
+          'properties': {
+            'vendor_id': { 'type': 'integer' },
+            'product_id': { 'type': 'integer' },
+          },
+        },
+      },
+      'supported_on': ['chrome_os:51-'],
+      'device_only': True,
+      'features': {
+        'dynamic_refresh': True,
+      },
+      'example_value': [
+        {
+          'vendor_id' : 0x0403,
+          'product_id' : 0x6001,
+        },
+        {
+          'vendor_id' : 0x413c,
+          'product_id' : 0x2105,
+        }
+      ],
+      'id': 317,

[vpalatin, 2016/03/01 01:54:23]

I'm not sure what id I'm supposed to put here.
I have put the highest one I found in the file + 1 ...

[bartfab (slow), 2016/03/01 14:49:57]

You did the right thing, but you could have just looked at line 140 to find the
highest number used :). And while we are on the topic: Please update line 140.

[vpalatin, 2016/03/01 17:49:01]

Done.

+      'caption': '''white list of USB detachable devices''',

[bartfab (slow), 2016/03/01 14:49:57]

Nit: s/white list/Whitelist/

[vpalatin, 2016/03/01 17:49:01]

Done.

+      'tags': [],

[bartfab (slow), 2016/03/01 14:49:57]

I am wondering whether this should be tagged full-admin-access and/or
system-security. After all, the admin can use it to MitM e.g. a USB keyboard.

[vpalatin, 2016/03/01 17:49:01]

'system-security' definitely, I will add it.

From the description of 'full-admin-access', I don't feel it's really the case.
But feel free to insist, I will add it

+      'desc': '''Defines the list of USB devices that are allowed to be detached from their kernel driver in order to be used through the chrome.usb API directly inside a web application. Entries are pairs of USB Vendor Identifier and Product Identifier to identify a specific hardware.
+
+      If this policy is not configured, the list of a detachable USB devices is considered as empty.''',
+    },

[bartfab (slow), 2016/03/01 14:49:57]

Note that you need to add this policy to histograms.xml as well.

[vpalatin, 2016/03/01 17:49:01]

I did not understand what I was supposed to do for this file.
Digging into other CLs, I imagine I should add it to "EnterprisePolicies" enum
even though it suggests it's generated from the .json file.
is that it ?

[bartfab (slow), 2016/03/02 10:40:33]

Yes, this is all you had to do.

I was curious about the comment which suggests the list is auto-generated. As it
turns out, there is a script:

tools/metrics/histograms/update_policies.py

However, I have to yet hear about anyone actually using it. We always update the
file manually :).

   ],
   'messages': {
     # Messages that are not associated to any policies.
     'win_supported_winxpsp2': {
       'desc': '''A label specifying the oldest possible compatible version of Windows. This text will appear right next to a label containing the text 'Supported on:'.''',
       'text': '''Microsoft Windows XP SP2 or later'''
     },
     'mac_chrome_preferences': {
       'desc': '''A text indicating in Mac OS X Workgroup Manager, that currently the preferences of Chromium are being edited''',
       'text': '''<ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> preferences'''
@@ skipping 109 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }