Block all web requests until force enrollment status has been confirmed.

chrome/browser/policy/policy_helpers.cc

Index: chrome/browser/policy/policy_helpers.cc
diff --git a/chrome/browser/policy/policy_helpers.cc b/chrome/browser/policy/policy_helpers.cc
index e9b6983d65117261a446f62a4c3f4f85f3912cba..3f840a04fa157ba20e83cf594ac5d979b069b426 100644
--- a/chrome/browser/policy/policy_helpers.cc
+++ b/chrome/browser/policy/policy_helpers.cc
@@ -6,6 +6,11 @@
 
 #include "url/gurl.h"
 
+#if defined(OS_CHROMEOS)
+#include "base/command_line.h"
+#include "chromeos/chromeos_switches.h"
+#endif
+
 #if !defined(OS_CHROMEOS) && !defined(OS_IOS)
 #include "chrome/browser/signin/signin_manager.h"
 #include "google_apis/gaia/gaia_urls.h"
@@ -14,7 +19,18 @@
 namespace policy {
 
 bool OverrideBlacklistForURL(const GURL& url, bool* block) {
-#if defined(OS_CHROMEOS) || defined(OS_IOS)
+#if defined(OS_CHROMEOS)
+  // On ChromeOS browsing is only allowed once OOBE has completed. Therefore all
+  // requests are blocked until this condition is met.
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          chromeos::switches::kOobeGuestSession)) {
+    if (!url.SchemeIs("chrome") && !url.SchemeIs("chrome-extension")) {
+      *block = true;
+      return true;
+    }
+  }
+  return false;
+#elif defined(OS_IOS)
   return false;
 #else
   static const char kServiceLoginAuth[] = "/ServiceLoginAuth";