Device policy for LoginApps.

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 119 matching lines @@
 #   templates and documentation. The policy definition list that Chrome sees
 #   will include policies marked with 'future'. If a WIP policy isn't meant to
 #   be seen by the policy providers either, the 'supported_on' key should be set
 #   to an empty list.
 #
 # IDs:
 #   Since a Protocol Buffer definition is generated from this file, unique and
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 334
+#   For your editing convenience: highest ID currently used: 335
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
 #     $1 -> Google Chrome / Chromium
 #     $2 -> Google Chrome OS / Chromium OS
 #     $3 -> Google Chrome Frame / Chromium Frame
 #     $6 is reserved for doc_writer
 #
 # Device Policy:
 #   An additional flag 'device_only' (optional, defaults to False) indicates
@@ skipping 8372 matching lines @@
       'id': 328,
       'caption': '''URLs that will be granted access to video capture devices on SAML login pages''',
       'tags': ['website-sharing'],
       'desc': '''Patterns in this list will be matched against the security
       origin of the requesting URL.  If a match is found, access to video
       capture devices will be granted on SAML login pages.  If no match is
       found, access will be automatically denied.  Wildcard patterns are not
       allowed.'''
     },
     {
+      'name': 'LoginApps',
+      'type': 'list',
+      'schema': {
+        'type': 'array',
+        'items': { 'type': 'string' },
+      },
+      'supported_on': ['chrome_os:54-'],
+      'device_only': True,
+      'features': {
+        'dynamic_refresh': True,
+      },
+      'example_value': ['gbchcmhmhahfdphkhkmpfmihenigjmpp;https://clients2.google.com/service/update2/crx'],
+      'id': 335,
+      'caption': '''Configure the list of installed apps on the login screen''',
+      'tags': ['full-admin-access'],
+      'desc': '''
+      Specifies a list of apps that are installed silently on the login screen,
+      without user interaction, and which cannot be uninstalled.
+      All permissions requested by the apps are granted
+      implicitly, without user interaction, including any additional
+      permissions requested by future versions of the app.
+
+      If an app that previously had been force-installed is removed from
+      this list, it is automatically uninstalled by <ph name="PRODUCT_NAME">$1<ex>Google
+      Chrome</ex></ph>.
+
+      Each list item of the policy is a string that contains an extension ID
+      and an "update" URL separated by a semicolon (<ph
+      name="SEMICOLON">;</ph>). The extension ID is the 32-letter string
+      found e.g. on <ph
+      name="CHROME_EXTENSIONS_LINK">chrome://extensions</ph> when in
+      developer mode. The "update" URL should point to an Update Manifest
+      XML document as described at <ph
+      name="LINK_TO_EXTENSION_DOC1">https://developer.chrome.com/extensions/autoupdate</ph>. Note
+      that the "update" URL set in this policy is only used for the initial
+      installation; subsequent updates of the extension employ the update
+      URL indicated in the extension's manifest.
+
+      For example, <ph
+      name="EXTENSION_POLICY_EXAMPLE">gbchcmhmhahfdphkhkmpfmihenigjmpp;https://clients2.google.com/service/update2/crx</ph>
+      installs the <ph name="EXTENSION_POLICY_EXAMPLE_EXTENSION_NAME">Chrome
+      Remote Desktop</ph> app from the standard Chrome Web Store "update"
+      URL. For more information about hosting extensions, see: <ph
+      name="LINK_TO_EXTENSION_DOC2">https://developer.chrome.com/extensions/hosting</ph>.''',
+    },
+    {
       'name': 'AllowScreenLock',
       'caption': '''Permit locking the screen''',
       'desc': '''Permit locking the screen.
 
       If this policy is set to false, users will not be able to lock the screen (only signing out from the user session will be possible). If this setting is set to true or not set, users who authenticated with a password can lock the screen.''',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:52-'],
       'features': {
         'dynamic_refresh': True,
@@ skipping 242 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }