| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h" | 5 #include "chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h" |
| 6 | 6 |
| 7 #include <keyhi.h> | 7 #include <keyhi.h> |
| 8 #include <stdint.h> | 8 #include <stdint.h> |
| 9 | 9 |
| 10 #include <algorithm> | 10 #include <algorithm> |
| (...skipping 141 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 152 scoped_refptr<base::TaskRunner> task_runner = | 152 scoped_refptr<base::TaskRunner> task_runner = |
| 153 BrowserThread::GetBlockingPool()->GetTaskRunnerWithShutdownBehavior( | 153 BrowserThread::GetBlockingPool()->GetTaskRunnerWithShutdownBehavior( |
| 154 base::SequencedWorkerPool::SKIP_ON_SHUTDOWN); | 154 base::SequencedWorkerPool::SKIP_ON_SHUTDOWN); |
| 155 base::PostTaskAndReplyWithResult( | 155 base::PostTaskAndReplyWithResult( |
| 156 task_runner.get(), | 156 task_runner.get(), |
| 157 FROM_HERE, | 157 FROM_HERE, |
| 158 base::Bind(&DoesPrivateKeyExistAsyncHelper, owner_key_util), | 158 base::Bind(&DoesPrivateKeyExistAsyncHelper, owner_key_util), |
| 159 callback); | 159 callback); |
| 160 } | 160 } |
| 161 | 161 |
| 162 // Returns true if it is okay to transfer from the current mode to the new | |
| 163 // mode. This function should be called in SetManagementMode(). | |
| 164 bool CheckManagementModeTransition(policy::ManagementMode current_mode, | |
| 165 policy::ManagementMode new_mode) { | |
| 166 // Mode is not changed. | |
| 167 if (current_mode == new_mode) | |
| 168 return true; | |
| 169 | |
| 170 switch (current_mode) { | |
| 171 case policy::MANAGEMENT_MODE_LOCAL_OWNER: | |
| 172 // For consumer management enrollment. | |
| 173 return new_mode == policy::MANAGEMENT_MODE_CONSUMER_MANAGED; | |
| 174 | |
| 175 case policy::MANAGEMENT_MODE_ENTERPRISE_MANAGED: | |
| 176 // Management mode cannot be set when it is currently ENTERPRISE_MANAGED. | |
| 177 return false; | |
| 178 | |
| 179 case policy::MANAGEMENT_MODE_CONSUMER_MANAGED: | |
| 180 // For consumer management unenrollment. | |
| 181 return new_mode == policy::MANAGEMENT_MODE_LOCAL_OWNER; | |
| 182 } | |
| 183 | |
| 184 NOTREACHED(); | |
| 185 return false; | |
| 186 } | |
| 187 | |
| 188 } // namespace | 162 } // namespace |
| 189 | 163 |
| 190 OwnerSettingsServiceChromeOS::ManagementSettings::ManagementSettings() { | 164 OwnerSettingsServiceChromeOS::ManagementSettings::ManagementSettings() { |
| 191 } | 165 } |
| 192 | 166 |
| 193 OwnerSettingsServiceChromeOS::ManagementSettings::~ManagementSettings() { | 167 OwnerSettingsServiceChromeOS::ManagementSettings::~ManagementSettings() { |
| 194 } | 168 } |
| 195 | 169 |
| 196 OwnerSettingsServiceChromeOS::OwnerSettingsServiceChromeOS( | 170 OwnerSettingsServiceChromeOS::OwnerSettingsServiceChromeOS( |
| 197 DeviceSettingsService* device_settings_service, | 171 DeviceSettingsService* device_settings_service, |
| 198 Profile* profile, | 172 Profile* profile, |
| 199 const scoped_refptr<OwnerKeyUtil>& owner_key_util) | 173 const scoped_refptr<OwnerKeyUtil>& owner_key_util) |
| 200 : ownership::OwnerSettingsService(owner_key_util), | 174 : ownership::OwnerSettingsService(owner_key_util), |
| 201 device_settings_service_(device_settings_service), | 175 device_settings_service_(device_settings_service), |
| 202 profile_(profile), | 176 profile_(profile), |
| 203 waiting_for_profile_creation_(true), | 177 waiting_for_profile_creation_(true), |
| 204 waiting_for_tpm_token_(true), | 178 waiting_for_tpm_token_(true), |
| 205 has_pending_fixups_(false), | 179 has_pending_fixups_(false), |
| 206 has_pending_management_settings_(false), | |
| 207 weak_factory_(this), | 180 weak_factory_(this), |
| 208 store_settings_factory_(this) { | 181 store_settings_factory_(this) { |
| 209 if (TPMTokenLoader::IsInitialized()) { | 182 if (TPMTokenLoader::IsInitialized()) { |
| 210 TPMTokenLoader::TPMTokenStatus tpm_token_status = | 183 TPMTokenLoader::TPMTokenStatus tpm_token_status = |
| 211 TPMTokenLoader::Get()->IsTPMTokenEnabled( | 184 TPMTokenLoader::Get()->IsTPMTokenEnabled( |
| 212 base::Bind(&OwnerSettingsServiceChromeOS::OnTPMTokenReady, | 185 base::Bind(&OwnerSettingsServiceChromeOS::OnTPMTokenReady, |
| 213 weak_factory_.GetWeakPtr())); | 186 weak_factory_.GetWeakPtr())); |
| 214 waiting_for_tpm_token_ = | 187 waiting_for_tpm_token_ = |
| 215 tpm_token_status == TPMTokenLoader::TPM_TOKEN_STATUS_UNDETERMINED; | 188 tpm_token_status == TPMTokenLoader::TPM_TOKEN_STATUS_UNDETERMINED; |
| 216 } | 189 } |
| (...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 255 DCHECK(thread_checker_.CalledOnValidThread()); | 228 DCHECK(thread_checker_.CalledOnValidThread()); |
| 256 waiting_for_tpm_token_ = false; | 229 waiting_for_tpm_token_ = false; |
| 257 | 230 |
| 258 // TPMTokenLoader initializes the TPM and NSS database which is necessary to | 231 // TPMTokenLoader initializes the TPM and NSS database which is necessary to |
| 259 // determine ownership. Force a reload once we know these are initialized. | 232 // determine ownership. Force a reload once we know these are initialized. |
| 260 ReloadKeypair(); | 233 ReloadKeypair(); |
| 261 } | 234 } |
| 262 | 235 |
| 263 bool OwnerSettingsServiceChromeOS::HasPendingChanges() const { | 236 bool OwnerSettingsServiceChromeOS::HasPendingChanges() const { |
| 264 return !pending_changes_.empty() || tentative_settings_.get() || | 237 return !pending_changes_.empty() || tentative_settings_.get() || |
| 265 has_pending_management_settings_ || has_pending_fixups_; | 238 has_pending_fixups_; |
| 266 } | 239 } |
| 267 | 240 |
| 268 bool OwnerSettingsServiceChromeOS::HandlesSetting(const std::string& setting) { | 241 bool OwnerSettingsServiceChromeOS::HandlesSetting(const std::string& setting) { |
| 269 if (base::CommandLine::ForCurrentProcess()->HasSwitch( | 242 if (base::CommandLine::ForCurrentProcess()->HasSwitch( |
| 270 switches::kStubCrosSettings)) { | 243 switches::kStubCrosSettings)) { |
| 271 return false; | 244 return false; |
| 272 } | 245 } |
| 273 return DeviceSettingsProvider::IsDeviceSetting(setting); | 246 return DeviceSettingsProvider::IsDeviceSetting(setting); |
| 274 } | 247 } |
| 275 | 248 |
| (...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 370 | 343 |
| 371 void OwnerSettingsServiceChromeOS::DeviceSettingsUpdated() { | 344 void OwnerSettingsServiceChromeOS::DeviceSettingsUpdated() { |
| 372 DCHECK(thread_checker_.CalledOnValidThread()); | 345 DCHECK(thread_checker_.CalledOnValidThread()); |
| 373 StorePendingChanges(); | 346 StorePendingChanges(); |
| 374 } | 347 } |
| 375 | 348 |
| 376 void OwnerSettingsServiceChromeOS::OnDeviceSettingsServiceShutdown() { | 349 void OwnerSettingsServiceChromeOS::OnDeviceSettingsServiceShutdown() { |
| 377 device_settings_service_ = nullptr; | 350 device_settings_service_ = nullptr; |
| 378 } | 351 } |
| 379 | 352 |
| 380 void OwnerSettingsServiceChromeOS::SetManagementSettings( | |
| 381 const ManagementSettings& settings, | |
| 382 const OnManagementSettingsSetCallback& callback) { | |
| 383 if ((!IsOwner() && !IsOwnerInTests(user_id_))) { | |
| 384 if (!callback.is_null()) | |
| 385 callback.Run(false /* success */); | |
| 386 return; | |
| 387 } | |
| 388 | |
| 389 policy::ManagementMode current_mode = policy::MANAGEMENT_MODE_LOCAL_OWNER; | |
| 390 if (has_pending_management_settings_) { | |
| 391 current_mode = pending_management_settings_.management_mode; | |
| 392 } else if (device_settings_service_ && | |
| 393 device_settings_service_->policy_data()) { | |
| 394 current_mode = | |
| 395 policy::GetManagementMode(*device_settings_service_->policy_data()); | |
| 396 } | |
| 397 | |
| 398 if (!CheckManagementModeTransition(current_mode, settings.management_mode)) { | |
| 399 LOG(ERROR) << "Invalid management mode transition: current mode = " | |
| 400 << current_mode << ", new mode = " << settings.management_mode; | |
| 401 if (!callback.is_null()) | |
| 402 callback.Run(false /* success */); | |
| 403 return; | |
| 404 } | |
| 405 | |
| 406 pending_management_settings_ = settings; | |
| 407 has_pending_management_settings_ = true; | |
| 408 pending_management_settings_callbacks_.push_back(callback); | |
| 409 StorePendingChanges(); | |
| 410 } | |
| 411 | |
| 412 // static | 353 // static |
| 413 void OwnerSettingsServiceChromeOS::IsOwnerForSafeModeAsync( | 354 void OwnerSettingsServiceChromeOS::IsOwnerForSafeModeAsync( |
| 414 const std::string& user_hash, | 355 const std::string& user_hash, |
| 415 const scoped_refptr<OwnerKeyUtil>& owner_key_util, | 356 const scoped_refptr<OwnerKeyUtil>& owner_key_util, |
| 416 const IsOwnerCallback& callback) { | 357 const IsOwnerCallback& callback) { |
| 417 CHECK(chromeos::LoginState::Get()->IsInSafeMode()); | 358 CHECK(chromeos::LoginState::Get()->IsInSafeMode()); |
| 418 | 359 |
| 419 // Make sure NSS is initialized and NSS DB is loaded for the user before | 360 // Make sure NSS is initialized and NSS DB is loaded for the user before |
| 420 // searching for the owner key. | 361 // searching for the owner key. |
| 421 BrowserThread::PostTaskAndReply( | 362 BrowserThread::PostTaskAndReply( |
| 422 BrowserThread::IO, | 363 BrowserThread::IO, |
| 423 FROM_HERE, | 364 FROM_HERE, |
| 424 base::Bind(base::IgnoreResult(&crypto::InitializeNSSForChromeOSUser), | 365 base::Bind(base::IgnoreResult(&crypto::InitializeNSSForChromeOSUser), |
| 425 user_hash, | 366 user_hash, |
| 426 ProfileHelper::GetProfilePathByUserIdHash(user_hash)), | 367 ProfileHelper::GetProfilePathByUserIdHash(user_hash)), |
| 427 base::Bind(&DoesPrivateKeyExistAsync, owner_key_util, callback)); | 368 base::Bind(&DoesPrivateKeyExistAsync, owner_key_util, callback)); |
| 428 } | 369 } |
| 429 | 370 |
| 430 // static | 371 // static |
| 431 std::unique_ptr<em::PolicyData> OwnerSettingsServiceChromeOS::AssemblePolicy( | 372 std::unique_ptr<em::PolicyData> OwnerSettingsServiceChromeOS::AssemblePolicy( |
| 432 const std::string& user_id, | 373 const std::string& user_id, |
| 433 const em::PolicyData* policy_data, | 374 const em::PolicyData* policy_data, |
| 434 bool apply_pending_management_settings, | |
| 435 const ManagementSettings& pending_management_settings, | |
| 436 em::ChromeDeviceSettingsProto* settings) { | 375 em::ChromeDeviceSettingsProto* settings) { |
| 437 std::unique_ptr<em::PolicyData> policy(new em::PolicyData()); | 376 std::unique_ptr<em::PolicyData> policy(new em::PolicyData()); |
| 438 if (policy_data) { | 377 if (policy_data) { |
| 439 // Preserve management settings. | 378 // Preserve management settings. |
| 440 if (policy_data->has_management_mode()) | 379 if (policy_data->has_management_mode()) |
| 441 policy->set_management_mode(policy_data->management_mode()); | 380 policy->set_management_mode(policy_data->management_mode()); |
| 442 if (policy_data->has_request_token()) | 381 if (policy_data->has_request_token()) |
| 443 policy->set_request_token(policy_data->request_token()); | 382 policy->set_request_token(policy_data->request_token()); |
| 444 if (policy_data->has_device_id()) | 383 if (policy_data->has_device_id()) |
| 445 policy->set_device_id(policy_data->device_id()); | 384 policy->set_device_id(policy_data->device_id()); |
| 446 } else { | 385 } else { |
| 447 // If there's no previous policy data, this is the first time the device | 386 // If there's no previous policy data, this is the first time the device |
| 448 // setting is set. We set the management mode to LOCAL_OWNER initially. | 387 // setting is set. We set the management mode to LOCAL_OWNER initially. |
| 449 policy->set_management_mode(em::PolicyData::LOCAL_OWNER); | 388 policy->set_management_mode(em::PolicyData::LOCAL_OWNER); |
| 450 } | 389 } |
| 451 if (apply_pending_management_settings) { | |
| 452 policy::SetManagementMode(*policy, | |
| 453 pending_management_settings.management_mode); | |
| 454 | |
| 455 if (pending_management_settings.request_token.empty()) | |
| 456 policy->clear_request_token(); | |
| 457 else | |
| 458 policy->set_request_token(pending_management_settings.request_token); | |
| 459 | |
| 460 if (pending_management_settings.device_id.empty()) | |
| 461 policy->clear_device_id(); | |
| 462 else | |
| 463 policy->set_device_id(pending_management_settings.device_id); | |
| 464 } | |
| 465 policy->set_policy_type(policy::dm_protocol::kChromeDevicePolicyType); | 390 policy->set_policy_type(policy::dm_protocol::kChromeDevicePolicyType); |
| 466 policy->set_timestamp( | 391 policy->set_timestamp( |
| 467 (base::Time::Now() - base::Time::UnixEpoch()).InMilliseconds()); | 392 (base::Time::Now() - base::Time::UnixEpoch()).InMilliseconds()); |
| 468 policy->set_username(user_id); | 393 policy->set_username(user_id); |
| 469 if (policy_data->management_mode() == em::PolicyData::LOCAL_OWNER || | 394 if (policy_data->management_mode() == em::PolicyData::LOCAL_OWNER || |
| 470 policy_data->management_mode() == em::PolicyData::CONSUMER_MANAGED) { | 395 policy_data->management_mode() == em::PolicyData::CONSUMER_MANAGED) { |
| 471 FixupLocalOwnerPolicy(user_id, settings); | 396 FixupLocalOwnerPolicy(user_id, settings); |
| 472 } | 397 } |
| 473 if (!settings->SerializeToString(policy->mutable_policy_value())) | 398 if (!settings->SerializeToString(policy->mutable_policy_value())) |
| 474 return std::unique_ptr<em::PolicyData>(); | 399 return std::unique_ptr<em::PolicyData>(); |
| (...skipping 290 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 765 } else { | 690 } else { |
| 766 return; | 691 return; |
| 767 } | 692 } |
| 768 | 693 |
| 769 for (const auto& change : pending_changes_) | 694 for (const auto& change : pending_changes_) |
| 770 UpdateDeviceSettings(change.first, *change.second, settings); | 695 UpdateDeviceSettings(change.first, *change.second, settings); |
| 771 pending_changes_.clear(); | 696 pending_changes_.clear(); |
| 772 | 697 |
| 773 std::unique_ptr<em::PolicyData> policy = | 698 std::unique_ptr<em::PolicyData> policy = |
| 774 AssemblePolicy(user_id_, device_settings_service_->policy_data(), | 699 AssemblePolicy(user_id_, device_settings_service_->policy_data(), |
| 775 has_pending_management_settings_, | 700 &settings); |
| 776 pending_management_settings_, &settings); | |
| 777 has_pending_fixups_ = false; | 701 has_pending_fixups_ = false; |
| 778 has_pending_management_settings_ = false; | |
| 779 | 702 |
| 780 bool rv = AssembleAndSignPolicyAsync( | 703 bool rv = AssembleAndSignPolicyAsync( |
| 781 content::BrowserThread::GetBlockingPool(), std::move(policy), | 704 content::BrowserThread::GetBlockingPool(), std::move(policy), |
| 782 base::Bind(&OwnerSettingsServiceChromeOS::OnPolicyAssembledAndSigned, | 705 base::Bind(&OwnerSettingsServiceChromeOS::OnPolicyAssembledAndSigned, |
| 783 store_settings_factory_.GetWeakPtr())); | 706 store_settings_factory_.GetWeakPtr())); |
| 784 if (!rv) | 707 if (!rv) |
| 785 ReportStatusAndContinueStoring(false /* success */); | 708 ReportStatusAndContinueStoring(false /* success */); |
| 786 } | 709 } |
| 787 | 710 |
| 788 void OwnerSettingsServiceChromeOS::OnPolicyAssembledAndSigned( | 711 void OwnerSettingsServiceChromeOS::OnPolicyAssembledAndSigned( |
| (...skipping 13 matching lines...) Expand all Loading... |
| 802 ReportStatusAndContinueStoring(success && | 725 ReportStatusAndContinueStoring(success && |
| 803 device_settings_service_->status() == | 726 device_settings_service_->status() == |
| 804 DeviceSettingsService::STORE_SUCCESS); | 727 DeviceSettingsService::STORE_SUCCESS); |
| 805 } | 728 } |
| 806 | 729 |
| 807 void OwnerSettingsServiceChromeOS::ReportStatusAndContinueStoring( | 730 void OwnerSettingsServiceChromeOS::ReportStatusAndContinueStoring( |
| 808 bool success) { | 731 bool success) { |
| 809 store_settings_factory_.InvalidateWeakPtrs(); | 732 store_settings_factory_.InvalidateWeakPtrs(); |
| 810 FOR_EACH_OBSERVER(OwnerSettingsService::Observer, observers_, | 733 FOR_EACH_OBSERVER(OwnerSettingsService::Observer, observers_, |
| 811 OnSignedPolicyStored(success)); | 734 OnSignedPolicyStored(success)); |
| 812 | |
| 813 std::vector<OnManagementSettingsSetCallback> callbacks; | |
| 814 pending_management_settings_callbacks_.swap(callbacks); | |
| 815 for (const auto& callback : callbacks) { | |
| 816 if (!callback.is_null()) | |
| 817 callback.Run(success); | |
| 818 } | |
| 819 StorePendingChanges(); | 735 StorePendingChanges(); |
| 820 } | 736 } |
| 821 | 737 |
| 822 } // namespace chromeos | 738 } // namespace chromeos |
| OLD | NEW |