Add policy provider that would filter extensions/apps allowed on the

chrome/browser/chromeos/extensions/signin_screen_policy_provider.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/extensions/signin_screen_policy_provider.h"
+
+#include <stddef.h>
+
+#include <cstddef>
+#include <string>
+
+#include "base/logging.h"
+#include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/values.h"
+#include "chrome/grit/generated_resources.h"
+#include "extensions/common/extension.h"
+#include "extensions/common/features/behavior_feature.h"
+#include "extensions/common/features/feature.h"
+#include "extensions/common/features/feature_provider.h"
+#include "extensions/common/manifest.h"
+#include "extensions/common/manifest_constants.h"
+#include "ui/base/l10n/l10n_util.h"
+
+namespace chromeos {
+
+SigninScreenPolicyProvider::SigninScreenPolicyProvider() {}
+
+SigninScreenPolicyProvider::~SigninScreenPolicyProvider() {}
+
+std::string SigninScreenPolicyProvider::GetDebugPolicyProviderName() const {
+#if defined(NDEBUG)
+  NOTREACHED();
+  return std::string();
+#else
+  return "Guard for sign-in screen";
+#endif
+}
+
+bool SigninScreenPolicyProvider::UserMayLoad(
+    const extensions::Extension* extension,
+    base::string16* error) const {
+  const extensions::Feature* feature =
+      extensions::FeatureProvider::GetBehaviorFeature(
+          extensions::BehaviorFeature::kSigninScreen);
+
+  if (feature) {
+    extensions::Feature::Availability availability =
+        feature->IsAvailableToExtension(extension);
+
+    if (availability.is_available()) {
+      VLOG(0) << "Extension allowed : " << extension->id() << " / "

[asargent_no_longer_on_chrome, 2016/11/09 05:50:43]

nit: (this line and below) Generally leaving logging statements like this in is
discouraged. See the logging section of the style guide:

https://chromium.googlesource.com/chromium/src/+/master/styleguide/c++/c++.md...

For chromeos, turning on VLOG output at runtime on release builds is impossible
(at least last I heard), and sometimes administrators need to be able to see
diagnostic information to understand certain behaviors of chrome or diagnose
problems, so sometimes an exception to the general rule is made, and we allow
specific LOG statements if there is a high probability they will be looked at
("just in case they might be useful" is typically not sufficient though). 

[Denis Kuznetsov (DE-MUC), 2016/11/09 13:42:35]

The intent was to provide external extension developers with meaningful message
in case when something goes wrong. As this particular situation is not easy to
reproduce (this code is triggered only on ChromeOS and only on the login screen)
I prefer verbosity.

I will change logging level to debug for failures and remove logging for success
case.

+              << extension->name();
+      return true;
+    }
+    VLOG(0) << "Extension disabled : " << extension->id() << " / "
+            << extension->name() << " because of " << availability.message();
+  } else {
+    VLOG(0) << "Feature " << extensions::BehaviorFeature::kSigninScreen
+            << " is not defined";
+  }
+
+  // Disallow all other extensions.
+  if (error) {
+    *error =
+        l10n_util::GetStringFUTF16(IDS_EXTENSION_CANT_INSTALL_ON_SIGNIN_SCREEN,
+                                   base::UTF8ToUTF16(extension->name()),
+                                   base::UTF8ToUTF16(extension->id()));
+  }
+  return false;
+}
+
+}  // namespace chromeos