Add policy provider that would filter extensions/apps allowed on the

extensions/common/api/_behavior_features.json

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This features file defines switches used to control Extension behaviour,
 // typically whitelist configuration.
 // See chrome/common/extensions/api/_features.md to understand this file, as
 // well as feature.h, simple_feature.h, and base_feature_provider.h.
 
 {
@@ skipping 23 matching lines @@
       "B11A93E7E5B541F8010245EBDE2C74647D6C14B9",  // http://crbug.com/505879
       "FA01E0B81978950F2BC5A50512FD769725F57510"   // http://crbug.com/505879
     ]
   },
   "zoom_without_bubble": {
     "channel": "stable",
     "extension_types": "all",
     "whitelist": [
       "CBCC42ABED43A4B58FE3810E62AFFA010EB0349F"   // https://crbug.com/538252
     ]
-  }
+  },
+  "signin_screen": [{
+    "blacklist": [
+      "9E527CDA9D7C50844E8A5DB964A54A640AE48F98"   // Chrome remote desktop
+    ],
+    "channel": "dev",
+    "extension_types": ["platform_app"],
+    "location": "policy",
+    "min_manifest_version": 2
+  }, {
+    "channel": "stable",
+    "platforms": ["chromeos"],

[emaxx, 2016/09/05 13:58:20]

Shouldn't this go into the first "branch" of the signin_screen feature too? I
think here it only applies to the whitelisted extensions.

[Denis Kuznetsov (DE-MUC), 2016/10/31 18:26:51]

Done.

+    "whitelist": [

[emaxx, 2016/09/05 13:58:20]

Shouldn't also the "component_extensions_auto_granted":false property be
specified, if the intention is to disallow some of the component extensions?

[Denis Kuznetsov (DE-MUC), 2016/10/31 18:26:51]

Done.

+      "E24F1786D842E91E74C27929B0B3715A4689A473",  // Gnubby component extension.
+      "6F9E349A0561C78A0D3F41496FE521C5151C7F71",  // Gnubby app

[emaxx, 2016/09/05 13:58:21]

I think I may already asked this in one of the previous iterations, but is
Gnubby app really useful on the login screen? Isn't it that only the Gnubby
extension is necessary for performing the authentication?

+      "8EBDF73405D0B84CEABB8C7513C9B9FA9F1DC2CE",  // Genius app (help)
+      "3F50C3A83839D9C76334BCE81CDEC06174F266AF"   // Virtual Keyboard
+    ]
+  }]
 }