Add policy provider that would filter extensions/apps allowed on the

chrome/browser/chromeos/extensions/signin_screen_policy_provider.h

+// Copyright 2013 The Chromium Authors. All rights reserved.

[emaxx, 2016/07/26 02:55:32]

nit: s/2013/2016/

[Denis Kuznetsov (DE-MUC), 2016/08/29 15:14:40]

Done.
I believe at some point there was (or it was just an idea?) a script that
updated year upon the commit of modified file.

+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_EXTENSIONS_SIGNIN_SCREEN_POLICY_PROVIDER_H_
+#define CHROME_BROWSER_CHROMEOS_EXTENSIONS_SIGNIN_SCREEN_POLICY_PROVIDER_H_
+
+#include "base/compiler_specific.h"

[emaxx, 2016/07/26 02:55:32]

nit: Please fix the includes in this and other new files.
E.g. here seems that "base/compiler_specific.h" and
"chrome/browser/chromeos/policy/device_local_account.h" are not actually used,
and <string>, "extensions/common/extension.h", "base/strings/string16.h" are
missing.

[Denis Kuznetsov (DE-MUC), 2016/08/29 15:14:40]

Done.

+#include "base/macros.h"
+#include "chrome/browser/chromeos/policy/device_local_account.h"
+#include "extensions/browser/management_policy.h"
+
+namespace chromeos {
+
+// A managed policy for apps on chromeos login screen.
+// It ensures that only very limited set of APIs are avaliable for such apps.
+class SigninScreenPolicyProvider
+    : public extensions::ManagementPolicy::Provider {
+ public:
+  SigninScreenPolicyProvider();
+  ~SigninScreenPolicyProvider() override;
+
+  // extensions::ManagementPolicy::Provider:
+  std::string GetDebugPolicyProviderName() const override;
+  bool UserMayLoad(const extensions::Extension* extension,
+                   base::string16* error) const override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SigninScreenPolicyProvider);
+};
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_EXTENSIONS_SIGNIN_SCREEN_POLICY_PROVIDER_H_