Add policy provider that would filter extensions/apps allowed on the

chrome/browser/extensions/extension_system_impl.cc

Index: chrome/browser/extensions/extension_system_impl.cc
diff --git a/chrome/browser/extensions/extension_system_impl.cc b/chrome/browser/extensions/extension_system_impl.cc
index ab1c01436412fd8ab89ee83eb0409d2ba6c7548a..64867f97f82d6b8a49dc986cb04ba2d5e675e93b 100644
--- a/chrome/browser/extensions/extension_system_impl.cc
+++ b/chrome/browser/extensions/extension_system_impl.cc
@@ -66,7 +66,9 @@
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/chromeos/app_mode/kiosk_app_update_install_gate.h"
 #include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+#include "chrome/browser/chromeos/extensions/signin_screen_policy_provider.h"
 #include "chrome/browser/chromeos/policy/device_local_account.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/login/login_state.h"
 #include "components/user_manager/user.h"
@@ -128,6 +130,9 @@ void ExtensionSystemImpl::Shared::InitPrefs() {
         new chromeos::DeviceLocalAccountManagementPolicyProvider(
             device_local_account_type));
   }
+// We can not perform check for Signin Profile here, as it would result in

[emaxx, 2016/11/10 14:44:32]

nit: The comment indentation seems to be wrong.

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:17]

Done.

[emaxx, 2016/11/11 16:11:36]

It's still indented with 0 spaces AFAICS.

+// recursive call upon creation of Signin Profile, so we will create
+// SigninScreenPolicyProvider lazily in RegisterManagementPolicyProviders.
 #endif  // defined(OS_CHROMEOS)
 }
 
@@ -137,10 +142,22 @@ void ExtensionSystemImpl::Shared::RegisterManagementPolicyProviders() {
           ->GetProviders());
 
 #if defined(OS_CHROMEOS)
+  // Lazy creation of SigninScreenPolicyProvider

[achuithb, 2016/11/11 00:36:28]

nit: period at end of comment

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:17]

Done.

+  if (!signin_screen_policy_provider_) {
+    if (profile_ ==

[achuithb, 2016/11/11 00:36:29]

Why not chromeos::ProfileHelper::IsSigninProfile(profile_)

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:17]

Because signin profile is the off-the-record profile for the "sign-in profile
parent", and we need to install the provider for the "sign-in profile parent"
(note the GetOriginalProfile()).

+        chromeos::ProfileHelper::GetSigninProfile()->GetOriginalProfile()) {
+      signin_screen_policy_provider_.reset(
+          new chromeos::SigninScreenPolicyProvider());
+    }
+  }
+
   if (device_local_account_management_policy_provider_) {
     management_policy_->RegisterProvider(
         device_local_account_management_policy_provider_.get());
   }
+  if (signin_screen_policy_provider_) {

[achuithb, 2016/11/11 00:36:28]

nit: don't need {}

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:17]

Done.

+    management_policy_->RegisterProvider(signin_screen_policy_provider_.get());
+  }
 #endif  // defined(OS_CHROMEOS)
 
   management_policy_->RegisterProvider(InstallVerifier::Get(profile_));