Only perform forced re-enrollment in official builds.

chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/logging.h"
@@ skipping 31 matching lines @@
     LOG(ERROR) << "Switch \"" << switch_name << "\" can't be greater than "
                << policy::AutoEnrollmentClient::kMaximumPower << ". Using "
                << policy::AutoEnrollmentClient::kMaximumPower;
     return policy::AutoEnrollmentClient::kMaximumPower;
   }
   return int_value;
 }
 
 }  // namespace
 
+const char AutoEnrollmentController::kForcedReEnrollmentAlways[] = "always";
+const char AutoEnrollmentController::kForcedReEnrollmentLegacy[] = "legacy";
+const char AutoEnrollmentController::kForcedReEnrollmentNever[] = "never";
+const char AutoEnrollmentController::kForcedReEnrollmentOfficialBuild[] =
+    "official";
+
+AutoEnrollmentController::Mode AutoEnrollmentController::GetMode() {
+  CommandLine* command_line = CommandLine::ForCurrentProcess();
+
+  if (!command_line->HasSwitch(switches::kEnterpriseEnableForcedReEnrollment))
+    return MODE_LEGACY_AUTO_ENROLLMENT;
+
+  std::string command_line_mode = command_line->GetSwitchValueASCII(
+      switches::kEnterpriseEnableForcedReEnrollment);
+  if (command_line_mode.empty() ||

[Joao da Silva, 2014/04/02 07:41:45]

Why?

[Mattias Nissler (ping if slow), 2014/04/02 07:45:00]

Because that's the original behavior of the flag and what is currently specified
in session_manager_setup.sh

[Joao da Silva, 2014/04/02 07:48:05]

Right, the flag could be used before without a value. Thanks!

[Mattias Nissler (ping if slow), 2014/04/02 13:10:39]

But in fact, it should only switch on FRE on official builds, so it was on the
wrong branch. Fixed now.

+      command_line_mode == kForcedReEnrollmentAlways) {
+    return MODE_FORCED_RE_ENROLLMENT;
+  } else if (command_line_mode == kForcedReEnrollmentOfficialBuild) {
+#if defined(OFFICIAL_BUILD)
+    return MODE_FORCED_RE_ENROLLMENT;
+#else
+    return MODE_NONE;
+#endif
+  } else if (command_line_mode == kForcedReEnrollmentLegacy) {
+    return MODE_LEGACY_AUTO_ENROLLMENT;
+  }
+
+  return MODE_NONE;
+}
+
 AutoEnrollmentController::AutoEnrollmentController()
     : state_(policy::AUTO_ENROLLMENT_STATE_IDLE),
       weak_factory_(this) {}
 
 AutoEnrollmentController::~AutoEnrollmentController() {}
 
 void AutoEnrollmentController::Start() {
   // This method is called at the point in the OOBE/login flow at which the
   // auto-enrollment check can start. This happens either after the EULA is
   // accepted, or right after a reboot if the EULA has already been accepted.
 
   // Do not communicate auto-enrollment data to the server if
   // 1. we are running integration or perf tests with telemetry.
   // 2. modulus configuration is not present.
+  // 3. Auto-enrollment is disabled via the command line.
+
   CommandLine* command_line = CommandLine::ForCurrentProcess();
   if (command_line->HasSwitch(chromeos::switches::kOobeSkipPostLogin) ||
       (!command_line->HasSwitch(
            chromeos::switches::kEnterpriseEnrollmentInitialModulus) &&
        !command_line->HasSwitch(
-           chromeos::switches::kEnterpriseEnrollmentModulusLimit))) {
+           chromeos::switches::kEnterpriseEnrollmentModulusLimit)) ||
+      GetMode() == MODE_NONE) {
     VLOG(1) << "Auto-enrollment disabled.";
     UpdateState(policy::AUTO_ENROLLMENT_STATE_NO_ENROLLMENT);
     return;
   }
 
   // If there already is a client, bail out.
   if (client_)
     return;
 
   // Start by checking if the device has already been owned.
@@ skipping 17 matching lines @@
     client_->Retry();
 }
 
 scoped_ptr<AutoEnrollmentController::ProgressCallbackList::Subscription>
 AutoEnrollmentController::RegisterProgressCallback(
     const ProgressCallbackList::CallbackType& callback) {
   return progress_callbacks_.Add(callback);
 }
 
 bool AutoEnrollmentController::ShouldEnrollSilently() {
-  return !CommandLine::ForCurrentProcess()->HasSwitch(
-             chromeos::switches::kEnterpriseEnableForcedReEnrollment) &&
-         state_ == policy::AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT;
+  return state_ == policy::AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT &&
+         GetMode() == MODE_LEGACY_AUTO_ENROLLMENT;
 }
 
 void AutoEnrollmentController::OnOwnershipStatusCheckDone(
     DeviceSettingsService::OwnershipStatus status) {
   if (status != DeviceSettingsService::OWNERSHIP_NONE) {
     // The device is already owned. No need for auto-enrollment checks.
     VLOG(1) << "Device already owned, skipping auto-enrollment check";
     UpdateState(policy::AUTO_ENROLLMENT_STATE_NO_ENROLLMENT);
     return;
   }
 
   policy::BrowserPolicyConnector* connector =
       g_browser_process->browser_policy_connector();
   policy::DeviceManagementService* service =
       connector->device_management_service();
   service->ScheduleInitialization(0);
 
   int power_initial = GetSanitizedArg(
       chromeos::switches::kEnterpriseEnrollmentInitialModulus);
   int power_limit = GetSanitizedArg(
       chromeos::switches::kEnterpriseEnrollmentModulusLimit);
   if (power_initial > power_limit) {
     LOG(ERROR) << "Initial auto-enrollment modulus is larger than the limit, "
                << "clamping to the limit.";
     power_initial = power_limit;
   }
 
   bool retrieve_device_state = false;
   std::string device_id;
-  if (CommandLine::ForCurrentProcess()->HasSwitch(
-          chromeos::switches::kEnterpriseEnableForcedReEnrollment)) {
+  if (GetMode() == MODE_FORCED_RE_ENROLLMENT) {
     retrieve_device_state = true;
     device_id =
         policy::DeviceCloudPolicyManagerChromeOS::GetCurrentDeviceStateKey();
   } else {
     device_id = policy::DeviceCloudPolicyManagerChromeOS::GetMachineID();
   }
 
   client_.reset(new policy::AutoEnrollmentClient(
       base::Bind(&AutoEnrollmentController::UpdateState,
                  base::Unretained(this)),
       service,
       g_browser_process->local_state(),
       g_browser_process->system_request_context(),
       device_id,
       retrieve_device_state,
       power_initial,
       power_limit));
 
   VLOG(1) << "Starting auto-enrollment client.";
   client_->Start();
 }
 
 void AutoEnrollmentController::UpdateState(
     policy::AutoEnrollmentState new_state) {
   state_ = new_state;
   progress_callbacks_.Notify(state_);
 }
 
 }  // namespace chromeos