Add policy provider that would filter extensions/apps allowed on the

chrome/browser/extensions/extension_system_impl.cc

Index: chrome/browser/extensions/extension_system_impl.cc
diff --git a/chrome/browser/extensions/extension_system_impl.cc b/chrome/browser/extensions/extension_system_impl.cc
index fa7596f5ad8971e9170674d058eb884391aea2e6..b011caecf2b27e4821ec02980910d6e185d4fa66 100644
--- a/chrome/browser/extensions/extension_system_impl.cc
+++ b/chrome/browser/extensions/extension_system_impl.cc
@@ -66,7 +66,9 @@
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/chromeos/app_mode/kiosk_app_update_install_gate.h"
 #include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+#include "chrome/browser/chromeos/extensions/signin_screen_policy_provider.h"
 #include "chrome/browser/chromeos/policy/device_local_account.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/login/login_state.h"
 #include "components/user_manager/user.h"
@@ -127,6 +129,9 @@ void ExtensionSystemImpl::Shared::InitPrefs() {
         new chromeos::DeviceLocalAccountManagementPolicyProvider(
             device_local_account_type));
   }
+// We can not perform check for Signin Profile here, as it would result in

[emaxx, 2016/07/26 02:55:32]

If the profile creation is really the only reason for doing this, then what
about implementing this check for signin profile more accurately, e.g. by
comparing the profile path? And such helper function could be put into
profile_helper.h.

[Denis Kuznetsov (DE-MUC), 2016/08/29 15:14:40]

I prefer to have explicit check on instance. For example,  path check would work
for both signin profile, and it's parent (e.g. non-incognito profile). And we
want to enable extensions only for non-incognito profile.

+// recursive call upon creation of Signin Profile, so we will create
+// SigninScreenPolicyProvider lazily in RegisterManagementPolicyProviders.
 #endif  // defined(OS_CHROMEOS)
 }
 
@@ -136,10 +141,22 @@ void ExtensionSystemImpl::Shared::RegisterManagementPolicyProviders() {
           ->GetProviders());
 
 #if defined(OS_CHROMEOS)
+  // Lazy creation of SigninScreenPolicyProvider
+  if (!signin_screen_policy_provider_) {
+    if (profile_ ==
+        chromeos::ProfileHelper::GetSigninProfile()->GetOriginalProfile()) {
+      signin_screen_policy_provider_.reset(
+          new chromeos::SigninScreenPolicyProvider());
+    }
+  }
+
   if (device_local_account_management_policy_provider_) {
     management_policy_->RegisterProvider(
         device_local_account_management_policy_provider_.get());
   }
+  if (signin_screen_policy_provider_) {
+    management_policy_->RegisterProvider(signin_screen_policy_provider_.get());
+  }
 #endif  // defined(OS_CHROMEOS)
 
   management_policy_->RegisterProvider(InstallVerifier::Get(profile_));