| OLD | NEW |
|---|
| (Empty) |
| 1 # Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 # Use of this source code is governed by a BSD-style license that can be | |
| 3 # found in the LICENSE file. | |
| 4 | |
| 5 """Base class for tests that need to update the policies enforced by Chrome. | |
| 6 | |
| 7 Subclasses can call SetUserPolicy (ChromeOS, Linux, Windows) and | |
| 8 SetDevicePolicy (ChromeOS only) with a dictionary of the policies to install. | |
| 9 | |
| 10 The current implementation depends on the platform. The implementations might | |
| 11 change in the future, but tests relying on the above calls will keep working. | |
| 12 """ | |
| 13 | |
| 14 # On ChromeOS, a mock DMServer is started and enterprise enrollment faked | |
| 15 # against it. The mock DMServer then serves user and device policy to Chrome. | |
| 16 # | |
| 17 # For this setup to work, the DNS, GAIA and TPM (if present) are mocked as well: | |
| 18 # | |
| 19 # * The mock DNS resolves all addresses to 127.0.0.1. This allows the mock GAIA | |
| 20 # to handle all login attempts. It also eliminates the impact of flaky network | |
| 21 # connections on tests. Beware though that no cloud services can be accessed | |
| 22 # due to this DNS redirect. | |
| 23 # | |
| 24 # * The mock GAIA permits login with arbitrary credentials and accepts any OAuth | |
| 25 # tokens sent to it for verification as valid. | |
| 26 # | |
| 27 # * When running on a real device, its TPM is disabled. If the TPM were enabled, | |
| 28 # enrollment could not be undone without a reboot. Disabling the TPM makes | |
| 29 # cryptohomed behave as if no TPM was present, allowing enrollment to be | |
| 30 # undone by removing the install attributes. | |
| 31 # | |
| 32 # To disable the TPM, 0 must be written to /sys/class/misc/tpm0/device/enabled. | |
| 33 # Since this file is not writeable, a tpmfs is mounted that shadows the file | |
| 34 # with a writeable copy. | |
| 35 | |
| 36 import json | |
| 37 import logging | |
| 38 import os | |
| 39 import subprocess | |
| 40 | |
| 41 import pyauto | |
| 42 | |
| 43 if pyauto.PyUITest.IsChromeOS(): | |
| 44 import sys | |
| 45 import warnings | |
| 46 | |
| 47 import pyauto_paths | |
| 48 | |
| 49 # Ignore deprecation warnings, they make our output more cluttered. | |
| 50 warnings.filterwarnings('ignore', category=DeprecationWarning) | |
| 51 | |
| 52 # Find the path to the pyproto and add it to sys.path. | |
| 53 # Prepend it so that google.protobuf is loaded from here. | |
| 54 for path in pyauto_paths.GetBuildDirs(): | |
| 55 p = os.path.join(path, 'pyproto') | |
| 56 if os.path.isdir(p): | |
| 57 sys.path = [p, os.path.join(p, 'chrome', 'browser', 'policy', | |
| 58 'proto')] + sys.path | |
| 59 break | |
| 60 sys.path.append('/usr/local') # to import autotest libs. | |
| 61 | |
| 62 import dbus | |
| 63 import device_management_backend_pb2 as dm | |
| 64 import pyauto_utils | |
| 65 import string | |
| 66 import tempfile | |
| 67 import urllib | |
| 68 import urllib2 | |
| 69 import uuid | |
| 70 from autotest.cros import auth_server | |
| 71 from autotest.cros import constants | |
| 72 from autotest.cros import cros_ui | |
| 73 from autotest.cros import dns_server | |
| 74 elif pyauto.PyUITest.IsWin(): | |
| 75 import _winreg as winreg | |
| 76 elif pyauto.PyUITest.IsMac(): | |
| 77 import getpass | |
| 78 import plistlib | |
| 79 | |
| 80 # ASN.1 object identifier for PKCS#1/RSA. | |
| 81 PKCS1_RSA_OID = '\x2a\x86\x48\x86\xf7\x0d\x01\x01\x01' | |
| 82 | |
| 83 TPM_SYSFS_PATH = '/sys/class/misc/tpm0' | |
| 84 TPM_SYSFS_ENABLED_FILE = os.path.join(TPM_SYSFS_PATH, 'device/enabled') | |
| 85 | |
| 86 | |
| 87 class PolicyTestBase(pyauto.PyUITest): | |
| 88 """A base class for tests that need to set up and modify policies. | |
| 89 | |
| 90 Subclasses can use the methods SetUserPolicy (ChromeOS, Linux, Windows) and | |
| 91 SetDevicePolicy (ChromeOS only) to set the policies seen by Chrome. | |
| 92 """ | |
| 93 | |
| 94 if pyauto.PyUITest.IsChromeOS(): | |
| 95 # TODO(bartfab): Extend the C++ wrapper that starts the mock DMServer so | |
| 96 # that an owner can be passed in. Without this, the server will assume that | |
| 97 # the owner is user@example.com and for consistency, so must we. | |
| 98 owner = 'user@example.com' | |
| 99 # Subclasses may override these credentials to fake enrollment into another | |
| 100 # mode or use different device and machine IDs. | |
| 101 mode = 'enterprise' | |
| 102 device_id = string.upper(str(uuid.uuid4())) | |
| 103 machine_id = 'CROSTEST' | |
| 104 | |
| 105 _auth_server = None | |
| 106 _dns_server = None | |
| 107 | |
| 108 def ShouldAutoLogin(self): | |
| 109 return False | |
| 110 | |
| 111 @staticmethod | |
| 112 def _Call(command, check=False): | |
| 113 """Invokes a subprocess and optionally asserts the return value is zero.""" | |
| 114 with open(os.devnull, 'w') as devnull: | |
| 115 if check: | |
| 116 return subprocess.check_call(command.split(' '), stdout=devnull) | |
| 117 else: | |
| 118 return subprocess.call(command.split(' '), stdout=devnull) | |
| 119 | |
| 120 def _WriteFile(self, path, content): | |
| 121 """Writes content to path, creating any intermediary directories.""" | |
| 122 if not os.path.exists(os.path.dirname(path)): | |
| 123 os.makedirs(os.path.dirname(path)) | |
| 124 f = open(path, 'w') | |
| 125 f.write(content) | |
| 126 f.close() | |
| 127 | |
| 128 def _GetTestServerPoliciesFilePath(self): | |
| 129 """Returns the path of the cloud policy configuration file.""" | |
| 130 assert self.IsChromeOS() | |
| 131 return os.path.join(self._temp_data_dir, 'device_management') | |
| 132 | |
| 133 def _GetHttpURLForDeviceManagement(self): | |
| 134 """Returns the URL at which the TestServer is serving user policy.""" | |
| 135 assert self.IsChromeOS() | |
| 136 return self._http_server.GetURL('device_management').spec() | |
| 137 | |
| 138 def _RemoveIfExists(self, filename): | |
| 139 """Removes a file if it exists.""" | |
| 140 if os.path.exists(filename): | |
| 141 os.remove(filename) | |
| 142 | |
| 143 def _StartSessionManagerAndChrome(self): | |
| 144 """Starts the session manager and Chrome. | |
| 145 | |
| 146 Requires that the session manager be stopped already. | |
| 147 """ | |
| 148 # Ugly hack: session manager will not spawn Chrome if this file exists. That | |
| 149 # is usually a good thing (to keep the automation channel open), but in this | |
| 150 # case we really want to restart chrome. PyUITest.setUp() will be called | |
| 151 # after session manager and chrome have restarted, and will setup the | |
| 152 # automation channel. | |
| 153 restore_magic_file = False | |
| 154 if os.path.exists(constants.DISABLE_BROWSER_RESTART_MAGIC_FILE): | |
| 155 logging.debug('DISABLE_BROWSER_RESTART_MAGIC_FILE found. ' | |
| 156 'Removing temporarily for the next restart.') | |
| 157 restore_magic_file = True | |
| 158 os.remove(constants.DISABLE_BROWSER_RESTART_MAGIC_FILE) | |
| 159 assert not os.path.exists(constants.DISABLE_BROWSER_RESTART_MAGIC_FILE) | |
| 160 | |
| 161 logging.debug('Starting session manager again') | |
| 162 cros_ui.start() | |
| 163 | |
| 164 # cros_ui.start() waits for the login prompt to be visible, so Chrome has | |
| 165 # already started once it returns. | |
| 166 if restore_magic_file: | |
| 167 open(constants.DISABLE_BROWSER_RESTART_MAGIC_FILE, 'w').close() | |
| 168 assert os.path.exists(constants.DISABLE_BROWSER_RESTART_MAGIC_FILE) | |
| 169 | |
| 170 def _WritePolicyOnChromeOS(self): | |
| 171 """Updates the mock DMServer's input file with current policy.""" | |
| 172 assert self.IsChromeOS() | |
| 173 policy_dict = { | |
| 174 'google/chromeos/device': self._device_policy, | |
| 175 'google/chromeos/user': { | |
| 176 'mandatory': self._user_policy, | |
| 177 'recommended': {}, | |
| 178 }, | |
| 179 'managed_users': ['*'], | |
| 180 } | |
| 181 self._WriteFile(self._GetTestServerPoliciesFilePath(), | |
| 182 json.dumps(policy_dict, sort_keys=True, indent=2) + '\n') | |
| 183 | |
| 184 @staticmethod | |
| 185 def _IsCryptohomedReadyOnChromeOS(): | |
| 186 """Checks whether cryptohomed is running and ready to accept DBus calls.""" | |
| 187 assert pyauto.PyUITest.IsChromeOS() | |
| 188 try: | |
| 189 bus = dbus.SystemBus() | |
| 190 proxy = bus.get_object('org.chromium.Cryptohome', | |
| 191 '/org/chromium/Cryptohome') | |
| 192 dbus.Interface(proxy, 'org.chromium.CryptohomeInterface') | |
| 193 except dbus.DBusException: | |
| 194 return False | |
| 195 return True | |
| 196 | |
| 197 def _ClearInstallAttributesOnChromeOS(self): | |
| 198 """Resets the install attributes.""" | |
| 199 assert self.IsChromeOS() | |
| 200 self._RemoveIfExists('/home/.shadow/install_attributes.pb') | |
| 201 self._Call('restart cryptohomed', check=True) | |
| 202 assert self.WaitUntil(self._IsCryptohomedReadyOnChromeOS) | |
| 203 | |
| 204 def _DMPostRequest(self, request_type, request, headers): | |
| 205 """Posts a request to the mock DMServer.""" | |
| 206 assert self.IsChromeOS() | |
| 207 url = self._GetHttpURLForDeviceManagement() | |
| 208 url += '?' + urllib.urlencode({ | |
| 209 'deviceid': self.device_id, | |
| 210 'oauth_token': 'dummy_oauth_token_that_is_not_checked_anyway', | |
| 211 'request': request_type, | |
| 212 'devicetype': 2, | |
| 213 'apptype': 'Chrome', | |
| 214 'agent': 'Chrome', | |
| 215 }) | |
| 216 response = dm.DeviceManagementResponse() | |
| 217 response.ParseFromString(urllib2.urlopen(urllib2.Request( | |
| 218 url, request.SerializeToString(), headers)).read()) | |
| 219 return response | |
| 220 | |
| 221 def _DMRegisterDevice(self): | |
| 222 """Registers with the mock DMServer and returns the DMToken.""" | |
| 223 assert self.IsChromeOS() | |
| 224 dm_request = dm.DeviceManagementRequest() | |
| 225 request = dm_request.register_request | |
| 226 request.type = dm.DeviceRegisterRequest.DEVICE | |
| 227 request.machine_id = self.machine_id | |
| 228 dm_response = self._DMPostRequest('register', dm_request, {}) | |
| 229 return dm_response.register_response.device_management_token | |
| 230 | |
| 231 def _DMFetchPolicy(self, dm_token): | |
| 232 """Fetches device policy from the mock DMServer.""" | |
| 233 assert self.IsChromeOS() | |
| 234 dm_request = dm.DeviceManagementRequest() | |
| 235 policy_request = dm_request.policy_request | |
| 236 request = policy_request.request.add() | |
| 237 request.policy_type = 'google/chromeos/device' | |
| 238 request.signature_type = dm.PolicyFetchRequest.SHA1_RSA | |
| 239 headers = {'Authorization': 'GoogleDMToken token=' + dm_token} | |
| 240 dm_response = self._DMPostRequest('policy', dm_request, headers) | |
| 241 response = dm_response.policy_response.response[0] | |
| 242 assert response.policy_data | |
| 243 assert response.policy_data_signature | |
| 244 assert response.new_public_key | |
| 245 return response | |
| 246 | |
| 247 def ExtraChromeFlags(self): | |
| 248 """Sets up Chrome to use cloud policies on ChromeOS.""" | |
| 249 flags = pyauto.PyUITest.ExtraChromeFlags(self) | |
| 250 if self.IsChromeOS(): | |
| 251 while '--skip-oauth-login' in flags: | |
| 252 flags.remove('--skip-oauth-login') | |
| 253 url = self._GetHttpURLForDeviceManagement() | |
| 254 flags.append('--device-management-url=' + url) | |
| 255 flags.append('--disable-sync') | |
| 256 return flags | |
| 257 | |
| 258 def _SetUpWithSessionManagerStopped(self): | |
| 259 """Sets up the test environment after stopping the session manager.""" | |
| 260 assert self.IsChromeOS() | |
| 261 logging.debug('Stopping session manager') | |
| 262 cros_ui.stop(allow_fail=True) | |
| 263 | |
| 264 # Start mock GAIA server. | |
| 265 self._auth_server = auth_server.GoogleAuthServer() | |
| 266 self._auth_server.run() | |
| 267 | |
| 268 # Disable TPM if present. | |
| 269 if os.path.exists(TPM_SYSFS_PATH): | |
| 270 self._Call('mount -t tmpfs -o size=1k tmpfs %s' | |
| 271 % os.path.realpath(TPM_SYSFS_PATH), check=True) | |
| 272 self._WriteFile(TPM_SYSFS_ENABLED_FILE, '0') | |
| 273 | |
| 274 # Clear install attributes and restart cryptohomed to pick up the change. | |
| 275 self._ClearInstallAttributesOnChromeOS() | |
| 276 | |
| 277 # Set install attributes to mock enterprise enrollment. | |
| 278 bus = dbus.SystemBus() | |
| 279 proxy = bus.get_object('org.chromium.Cryptohome', | |
| 280 '/org/chromium/Cryptohome') | |
| 281 install_attributes = { | |
| 282 'enterprise.device_id': self.device_id, | |
| 283 'enterprise.domain': string.split(self.owner, '@')[-1], | |
| 284 'enterprise.mode': self.mode, | |
| 285 'enterprise.owned': 'true', | |
| 286 'enterprise.user': self.owner | |
| 287 } | |
| 288 interface = dbus.Interface(proxy, 'org.chromium.CryptohomeInterface') | |
| 289 for name, value in install_attributes.iteritems(): | |
| 290 interface.InstallAttributesSet(name, '%s\0' % value) | |
| 291 interface.InstallAttributesFinalize() | |
| 292 | |
| 293 # Start mock DNS server that redirects all traffic to 127.0.0.1. | |
| 294 self._dns_server = dns_server.LocalDns() | |
| 295 self._dns_server.run() | |
| 296 | |
| 297 # Start mock DMServer. | |
| 298 source_dir = os.path.normpath(pyauto_paths.GetSourceDir()) | |
| 299 self._temp_data_dir = tempfile.mkdtemp(dir=source_dir) | |
| 300 logging.debug('TestServer input path: %s' % self._temp_data_dir) | |
| 301 relative_temp_data_dir = os.path.basename(self._temp_data_dir) | |
| 302 self._http_server = self.StartHTTPServer(relative_temp_data_dir) | |
| 303 | |
| 304 # Initialize the policy served. | |
| 305 self._device_policy = {} | |
| 306 self._user_policy = {} | |
| 307 self._WritePolicyOnChromeOS() | |
| 308 | |
| 309 # Register with mock DMServer and retrieve initial device policy blob. | |
| 310 dm_token = self._DMRegisterDevice() | |
| 311 policy = self._DMFetchPolicy(dm_token) | |
| 312 | |
| 313 # Write the initial device policy blob. | |
| 314 self._WriteFile(constants.OWNER_KEY_FILE, policy.new_public_key) | |
| 315 self._WriteFile(constants.SIGNED_POLICY_FILE, policy.SerializeToString()) | |
| 316 | |
| 317 # Remove any existing vaults. | |
| 318 self.RemoveAllCryptohomeVaultsOnChromeOS() | |
| 319 | |
| 320 # Restart session manager and Chrome. | |
| 321 self._StartSessionManagerAndChrome() | |
| 322 | |
| 323 def _tearDownWithSessionManagerStopped(self): | |
| 324 """Resets the test environment after stopping the session manager.""" | |
| 325 assert self.IsChromeOS() | |
| 326 logging.debug('Stopping session manager') | |
| 327 cros_ui.stop(allow_fail=True) | |
| 328 | |
| 329 # Stop mock GAIA server. | |
| 330 if self._auth_server: | |
| 331 self._auth_server.stop() | |
| 332 | |
| 333 # Reenable TPM if present. | |
| 334 if os.path.exists(TPM_SYSFS_PATH): | |
| 335 self._Call('umount %s' % os.path.realpath(TPM_SYSFS_PATH)) | |
| 336 | |
| 337 # Clear install attributes and restart cryptohomed to pick up the change. | |
| 338 self._ClearInstallAttributesOnChromeOS() | |
| 339 | |
| 340 # Stop mock DNS server. | |
| 341 if self._dns_server: | |
| 342 self._dns_server.stop() | |
| 343 | |
| 344 # Stop mock DMServer. | |
| 345 self.StopHTTPServer(self._http_server) | |
| 346 | |
| 347 # Clear the policy served. | |
| 348 pyauto_utils.RemovePath(self._temp_data_dir) | |
| 349 | |
| 350 # Remove the device policy blob. | |
| 351 self._RemoveIfExists(constants.OWNER_KEY_FILE) | |
| 352 self._RemoveIfExists(constants.SIGNED_POLICY_FILE) | |
| 353 | |
| 354 # Remove any existing vaults. | |
| 355 self.RemoveAllCryptohomeVaultsOnChromeOS() | |
| 356 | |
| 357 # Restart session manager and Chrome. | |
| 358 self._StartSessionManagerAndChrome() | |
| 359 | |
| 360 def setUp(self): | |
| 361 """Sets up the platform for policy testing. | |
| 362 | |
| 363 On ChromeOS, part of the setup involves restarting the session manager to | |
| 364 inject an initial device policy blob. | |
| 365 """ | |
| 366 if self.IsChromeOS(): | |
| 367 # Perform the remainder of the setup with the device manager stopped. | |
| 368 try: | |
| 369 self.WaitForSessionManagerRestart( | |
| 370 self._SetUpWithSessionManagerStopped) | |
| 371 except: | |
| 372 # Destroy the non re-entrant services. | |
| 373 if self._auth_server: | |
| 374 self._auth_server.stop() | |
| 375 if self._dns_server: | |
| 376 self._dns_server.stop() | |
| 377 raise | |
| 378 | |
| 379 pyauto.PyUITest.setUp(self) | |
| 380 self._branding = self.GetBrowserInfo()['properties']['branding'] | |
| 381 | |
| 382 def tearDown(self): | |
| 383 """Cleans up the policies and related files created in tests.""" | |
| 384 if self.IsChromeOS(): | |
| 385 # Perform the cleanup with the device manager stopped. | |
| 386 self.WaitForSessionManagerRestart(self._tearDownWithSessionManagerStopped) | |
| 387 else: | |
| 388 # On other platforms, there is only user policy to clear. | |
| 389 self.SetUserPolicy(refresh=False) | |
| 390 | |
| 391 pyauto.PyUITest.tearDown(self) | |
| 392 | |
| 393 def LoginWithTestAccount(self, account='prod_enterprise_test_user'): | |
| 394 """Convenience method for logging in with one of the test accounts.""" | |
| 395 assert self.IsChromeOS() | |
| 396 credentials = self.GetPrivateInfo()[account] | |
| 397 self.Login(credentials['username'], credentials['password']) | |
| 398 assert self.GetLoginInfo()['is_logged_in'] | |
| 399 | |
| 400 def _GetCurrentLoginScreenId(self): | |
| 401 return self.ExecuteJavascriptInOOBEWebUI( | |
| 402 """window.domAutomationController.send( | |
| 403 String(cr.ui.Oobe.getInstance().currentScreen.id)); | |
| 404 """) | |
| 405 | |
| 406 def _WaitForLoginScreenId(self, id): | |
| 407 self.assertTrue( | |
| 408 self.WaitUntil(function=self._GetCurrentLoginScreenId, | |
| 409 expect_retval=id), | |
| 410 msg='Expected login screen "%s" to be visible.' % id) | |
| 411 | |
| 412 def _CheckLoginFormLoading(self): | |
| 413 return self.ExecuteJavascriptInOOBEWebUI( | |
| 414 """window.domAutomationController.send( | |
| 415 cr.ui.Oobe.getInstance().currentScreen.loading); | |
| 416 """) | |
| 417 | |
| 418 def PrepareToWaitForLoginFormReload(self): | |
| 419 self.assertEqual('gaia-signin', | |
| 420 self._GetCurrentLoginScreenId(), | |
| 421 msg='Expected the login form to be visible.') | |
| 422 self.assertTrue( | |
| 423 self.WaitUntil(function=self._CheckLoginFormLoading, | |
| 424 expect_retval=False), | |
| 425 msg='Expected the login form to finish loading.') | |
| 426 # Set up a sentinel variable that is false now and will toggle to true when | |
| 427 # the login form starts reloading. | |
| 428 self.ExecuteJavascriptInOOBEWebUI( | |
| 429 """var screen = cr.ui.Oobe.getInstance().currentScreen; | |
| 430 if (!('reload_started' in screen)) { | |
| 431 screen.orig_loadAuthExtension_ = screen.loadAuthExtension_; | |
| 432 screen.loadAuthExtension_ = function(data) { | |
| 433 this.orig_loadAuthExtension_(data); | |
| 434 if (this.loading) | |
| 435 this.reload_started = true; | |
| 436 } | |
| 437 } | |
| 438 screen.reload_started = false; | |
| 439 window.domAutomationController.send(true);""") | |
| 440 | |
| 441 def _CheckLoginFormReloaded(self): | |
| 442 return self.ExecuteJavascriptInOOBEWebUI( | |
| 443 """window.domAutomationController.send( | |
| 444 cr.ui.Oobe.getInstance().currentScreen.reload_started && | |
| 445 !cr.ui.Oobe.getInstance().currentScreen.loading); | |
| 446 """) | |
| 447 | |
| 448 def WaitForLoginFormReload(self): | |
| 449 self.assertEqual('gaia-signin', | |
| 450 self._GetCurrentLoginScreenId(), | |
| 451 msg='Expected the login form to be visible.') | |
| 452 self.assertTrue( | |
| 453 self.WaitUntil(function=self._CheckLoginFormReloaded), | |
| 454 msg='Expected the login form to finish reloading.') | |
| 455 | |
| 456 def _SetUserPolicyChromeOS(self, user_policy=None): | |
| 457 """Writes the given user policy to the mock DMServer's input file.""" | |
| 458 self._user_policy = user_policy or {} | |
| 459 self._WritePolicyOnChromeOS() | |
| 460 | |
| 461 def _SetUserPolicyWin(self, user_policy=None): | |
| 462 """Writes the given user policy to the Windows registry.""" | |
| 463 def SetValueEx(key, sub_key, value): | |
| 464 if isinstance(value, int): | |
| 465 winreg.SetValueEx(key, sub_key, 0, winreg.REG_DWORD, int(value)) | |
| 466 elif isinstance(value, basestring): | |
| 467 winreg.SetValueEx(key, sub_key, 0, winreg.REG_SZ, value.encode('ascii')) | |
| 468 elif isinstance(value, list): | |
| 469 k = winreg.CreateKey(key, sub_key) | |
| 470 for index, v in list(enumerate(value)): | |
| 471 SetValueEx(k, str(index + 1), v) | |
| 472 winreg.CloseKey(k) | |
| 473 else: | |
| 474 raise TypeError('Unsupported data type: "%s"' % value) | |
| 475 | |
| 476 assert self.IsWin() | |
| 477 if self._branding == 'Google Chrome': | |
| 478 reg_base = r'SOFTWARE\Policies\Google\Chrome' | |
| 479 else: | |
| 480 reg_base = r'SOFTWARE\Policies\Chromium' | |
| 481 | |
| 482 if subprocess.call( | |
| 483 r'reg query HKEY_LOCAL_MACHINE\%s' % reg_base) == 0: | |
| 484 logging.debug(r'Removing %s' % reg_base) | |
| 485 subprocess.call(r'reg delete HKLM\%s /f' % reg_base) | |
| 486 | |
| 487 if user_policy is not None: | |
| 488 root_key = winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, reg_base) | |
| 489 for k, v in user_policy.iteritems(): | |
| 490 SetValueEx(root_key, k, v) | |
| 491 winreg.CloseKey(root_key) | |
| 492 | |
| 493 def _SetUserPolicyLinux(self, user_policy=None): | |
| 494 """Writes the given user policy to the JSON policy file read by Chrome.""" | |
| 495 assert self.IsLinux() | |
| 496 sudo_cmd_file = os.path.join(os.path.dirname(__file__), | |
| 497 'policy_posix_util.py') | |
| 498 | |
| 499 if self._branding == 'Google Chrome': | |
| 500 policies_location_base = '/etc/opt/chrome' | |
| 501 else: | |
| 502 policies_location_base = '/etc/chromium' | |
| 503 | |
| 504 if os.path.exists(policies_location_base): | |
| 505 logging.debug('Removing directory %s' % policies_location_base) | |
| 506 subprocess.call(['suid-python', sudo_cmd_file, | |
| 507 'remove_dir', policies_location_base]) | |
| 508 | |
| 509 if user_policy is not None: | |
| 510 self._WriteFile('/tmp/chrome.json', | |
| 511 json.dumps(user_policy, sort_keys=True, indent=2) + '\n') | |
| 512 | |
| 513 policies_location = '%s/policies/managed' % policies_location_base | |
| 514 subprocess.call(['suid-python', sudo_cmd_file, | |
| 515 'setup_dir', policies_location]) | |
| 516 subprocess.call(['suid-python', sudo_cmd_file, | |
| 517 'perm_dir', policies_location]) | |
| 518 # Copy chrome.json file to the managed directory | |
| 519 subprocess.call(['suid-python', sudo_cmd_file, | |
| 520 'copy', '/tmp/chrome.json', policies_location]) | |
| 521 os.remove('/tmp/chrome.json') | |
| 522 | |
| 523 def _SetUserPolicyMac(self, user_policy=None): | |
| 524 """Writes the given user policy to the plist policy file read by Chrome.""" | |
| 525 assert self.IsMac() | |
| 526 sudo_cmd_file = os.path.join(os.path.dirname(__file__), | |
| 527 'policy_posix_util.py') | |
| 528 | |
| 529 if self._branding == 'Google Chrome': | |
| 530 policies_file_base = 'com.google.Chrome.plist' | |
| 531 else: | |
| 532 policies_file_base = 'org.chromium.Chromium.plist' | |
| 533 | |
| 534 policies_location = os.path.join('/Library', 'Managed Preferences', | |
| 535 getpass.getuser()) | |
| 536 | |
| 537 if os.path.exists(policies_location): | |
| 538 logging.debug('Removing directory %s' % policies_location) | |
| 539 subprocess.call(['suid-python', sudo_cmd_file, | |
| 540 'remove_dir', policies_location]) | |
| 541 | |
| 542 if user_policy is not None: | |
| 543 policies_tmp_file = os.path.join('/tmp', policies_file_base) | |
| 544 plistlib.writePlist(user_policy, policies_tmp_file) | |
| 545 subprocess.call(['suid-python', sudo_cmd_file, | |
| 546 'setup_dir', policies_location]) | |
| 547 # Copy policy file to the managed directory | |
| 548 subprocess.call(['suid-python', sudo_cmd_file, | |
| 549 'copy', policies_tmp_file, policies_location]) | |
| 550 os.remove(policies_tmp_file) | |
| 551 | |
| 552 def SetUserPolicy(self, user_policy=None, refresh=True): | |
| 553 """Sets the user policy provided as a dict. | |
| 554 | |
| 555 Args: | |
| 556 user_policy: The user policy to set. None clears it. | |
| 557 refresh: If True, Chrome will refresh and apply the new policy. | |
| 558 Requires Chrome to be alive for it. | |
| 559 """ | |
| 560 if self.IsChromeOS(): | |
| 561 self._SetUserPolicyChromeOS(user_policy=user_policy) | |
| 562 elif self.IsWin(): | |
| 563 self._SetUserPolicyWin(user_policy=user_policy) | |
| 564 elif self.IsLinux(): | |
| 565 self._SetUserPolicyLinux(user_policy=user_policy) | |
| 566 elif self.IsMac(): | |
| 567 self._SetUserPolicyMac(user_policy=user_policy) | |
| 568 else: | |
| 569 raise NotImplementedError('Not available on this platform.') | |
| 570 | |
| 571 if refresh: | |
| 572 self.RefreshPolicies() | |
| 573 | |
| 574 def SetDevicePolicy(self, device_policy=None, refresh=True): | |
| 575 """Sets the device policy provided as a dict. | |
| 576 | |
| 577 Args: | |
| 578 device_policy: The device policy to set. None clears it. | |
| 579 refresh: If True, Chrome will refresh and apply the new policy. | |
| 580 Requires Chrome to be alive for it. | |
| 581 """ | |
| 582 assert self.IsChromeOS() | |
| 583 self._device_policy = device_policy or {} | |
| 584 self._WritePolicyOnChromeOS() | |
| 585 if refresh: | |
| 586 self.RefreshPolicies() | |
| OLD | NEW |
|---|
Chromium Code Reviews
