Block all web requests until force enrollment status has been confirmed.

chrome/browser/policy/policy_helpers.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/policy_helpers.h"
 
 #include "url/gurl.h"
 
 #if !defined(OS_CHROMEOS) && !defined(OS_IOS)
 #include "chrome/browser/signin/signin_manager.h"
 #include "google_apis/gaia/gaia_urls.h"
 #endif
 
 namespace policy {
 
-bool OverrideBlacklistForURL(const GURL& url, bool* block) {
-#if defined(OS_CHROMEOS) || defined(OS_IOS)
+bool OverrideBlacklistForURL(bool is_oobe_done, const GURL& url, bool* block) {
+#if defined(OS_CHROMEOS)
+  // On ChromeOS browsing is only allowed once OOBE has completed. Therefore all
+  // requests are blocked until this condition is met.
+  if (!is_oobe_done) {
+    if (url.SchemeIsHTTPOrHTTPS()) {

[Mattias Nissler (ping if slow), 2014/03/25 08:31:32]

So FTP is still allowed? might just want to whitelist the schemes do want to
keep functional?

+      *block = true;
+      return true;
+    }
+  }
+  return false;
+#elif defined(OS_IOS)
   return false;
 #else
   static const char kServiceLoginAuth[] = "/ServiceLoginAuth";
 
   *block = false;
   // Whitelist all the signin flow URLs flagged by the SigninManager.
   if (SigninManager::IsWebBasedSigninFlowURL(url))
     return true;
 
   // Additionally whitelist /ServiceLoginAuth.
   if (url.GetOrigin() != GaiaUrls::GetInstance()->gaia_url().GetOrigin())
     return false;
 
   return url.path() == kServiceLoginAuth;
 #endif
 }
 
 }  // namespace policy