Add policy provider that would filter extensions/apps allowed on the

extensions/common/api/_behavior_features.json

Index: extensions/common/api/_behavior_features.json
diff --git a/extensions/common/api/_behavior_features.json b/extensions/common/api/_behavior_features.json
index 73dab5138f9ed6bbddbfd3aa481000377c20633f..2a38bde4a96a36bebd6723e6731d13b85d04efeb 100644
--- a/extensions/common/api/_behavior_features.json
+++ b/extensions/common/api/_behavior_features.json
@@ -46,5 +46,40 @@
     "channel": "dev",
     "extension_types": ["platform_app"],
     "session_types": ["kiosk"] 
+  },
+  "signin_screen": [ {

[Devlin, 2016/11/09 22:07:43]

How do we anticipate using this?  Will it eventually be open to arbitrary
apps/extensions, or will this always be whitelist only?

[Denis Kuznetsov (DE-MUC), 2016/11/10 14:12:11]

It will be open to all extensions installed via policy that match some extra
criteria (e.g. requested permissions) once we implement more in-depth defense
mechanisms.

+    "blacklist": [
+      "9E527CDA9D7C50844E8A5DB964A54A640AE48F98"   // Chrome remote desktop
+    ],
+    // Allow developers to test new feature.

[asargent_no_longer_on_chrome, 2016/11/09 21:59:48]

grammar nit: "feature" -> "features"

[Denis Kuznetsov (DE-MUC), 2016/11/10 14:12:12]

Done.

+    "channel": "dev",
+    "component_extensions_auto_granted": false,
+    "extension_types": ["platform_app"],
+    "location": "policy",
+    "min_manifest_version": 2,

[asargent_no_longer_on_chrome, 2016/11/09 21:59:49]

FYI, I don't think we really support installing extensions/apps/themes with
manifest version 1 anymore, so you don't need to bother including this
min_manifest_version key/val.

[Denis Kuznetsov (DE-MUC), 2016/11/10 14:12:11]

Done.

+    "platforms": ["chromeos"]
+  }, {
+    // Strict restrictions for stable channel.
+    // For now only whitelisted apps.
+    "channel": "stable",
+    "component_extensions_auto_granted": false,
+    "extension_types": ["platform_app"],
+    "location": "policy",
+    "min_manifest_version": 2,
+    "platforms": ["chromeos"],
+    "whitelist": [
+      "EC3DE21E048B67319893889529354DFBFA96FD23"  // Smart Card Connector
+    ]
+  }, {
+    // Explicitly whitelist extensions that should always be available on a singin screen.

[asargent_no_longer_on_chrome, 2016/11/09 21:59:49]

typo: "sing" -> "sign"

[Denis Kuznetsov (DE-MUC), 2016/11/10 14:12:11]

Done.

+    "channel": "stable",
+    "platforms": ["chromeos"],
+    "whitelist": [

[asargent_no_longer_on_chrome, 2016/11/09 21:59:49]

Did you intend for component_extensions_auto_granted to be true in this block?
(that's the default if not specified, I believe). 

[Denis Kuznetsov (DE-MUC), 2016/11/10 14:12:11]

Good catch, thanks.

+      "E24F1786D842E91E74C27929B0B3715A4689A473",  // Gnubby component extension
+      "6F9E349A0561C78A0D3F41496FE521C5151C7F71",  // Gnubby app
+      "8EBDF73405D0B84CEABB8C7513C9B9FA9F1DC2CE",  // Genius app (help)
+      "3F50C3A83839D9C76334BCE81CDEC06174F266AF"   // Virtual Keyboard
+    ]
   }
+  ]
 }