Add usb_detachable_whitelist to device policy proto

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 85d50010561ca2593e8708f2328616cdba56c818..276aacbd563bb6a78a5959e330e3064929b022c6 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -8178,6 +8178,42 @@
       free to change it. In this case, the default value is not reapplied at
       restart.''',
     },
+    {
+      'name': 'UsbDetachableWhitelist',
+      'type': 'list',
+      'schema': {
+        'type': 'array',
+        'items': {
+          'type': 'object',
+          'id': 'UsbDeviceId',
+          'properties': {
+            'vendor_id': { 'type': 'integer' },
+            'product_id': { 'type': 'integer' },
+          },
+        },
+      },
+      'supported_on': ['chrome_os:51-'],
+      'device_only': True,
+      'features': {
+        'dynamic_refresh': True,
+      },
+      'example_value': [
+        {
+          'vendor_id' : 0x0403,
+          'product_id' : 0x6001,
+        },
+        {
+          'vendor_id' : 0x413c,
+          'product_id' : 0x2105,
+        }
+      ],
+      'id': 317,

[vpalatin, 2016/03/01 01:54:23]

I'm not sure what id I'm supposed to put here.
I have put the highest one I found in the file + 1 ...

[bartfab (slow), 2016/03/01 14:49:57]

You did the right thing, but you could have just looked at line 140 to find the
highest number used :). And while we are on the topic: Please update line 140.

[vpalatin, 2016/03/01 17:49:01]

Done.

+      'caption': '''white list of USB detachable devices''',

[bartfab (slow), 2016/03/01 14:49:57]

Nit: s/white list/Whitelist/

[vpalatin, 2016/03/01 17:49:01]

Done.

+      'tags': [],

[bartfab (slow), 2016/03/01 14:49:57]

I am wondering whether this should be tagged full-admin-access and/or
system-security. After all, the admin can use it to MitM e.g. a USB keyboard.

[vpalatin, 2016/03/01 17:49:01]

'system-security' definitely, I will add it.

From the description of 'full-admin-access', I don't feel it's really the case.
But feel free to insist, I will add it

+      'desc': '''Defines the list of USB devices that are allowed to be detached from their kernel driver in order to be used through the chrome.usb API directly inside a web application. Entries are pairs of USB Vendor Identifier and Product Identifier to identify a specific hardware.
+
+      If this policy is not configured, the list of a detachable USB devices is considered as empty.''',
+    },

[bartfab (slow), 2016/03/01 14:49:57]

Note that you need to add this policy to histograms.xml as well.

[vpalatin, 2016/03/01 17:49:01]

I did not understand what I was supposed to do for this file.
Digging into other CLs, I imagine I should add it to "EnterprisePolicies" enum
even though it suggests it's generated from the .json file.
is that it ?

[bartfab (slow), 2016/03/02 10:40:33]

Yes, this is all you had to do.

I was curious about the comment which suggests the list is auto-generated. As it
turns out, there is a script:

tools/metrics/histograms/update_policies.py

However, I have to yet hear about anyone actually using it. We always update the
file manually :).

   ],
   'messages': {
     # Messages that are not associated to any policies.