| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h" |
| 6 | 6 |
| 7 #include <utility> | 7 #include <utility> |
| 8 | 8 |
| 9 #include "base/bind.h" | 9 #include "base/bind.h" |
| 10 #include "base/logging.h" | 10 #include "base/logging.h" |
| (...skipping 126 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 137 void DeviceCloudPolicyStoreChromeOS::OnPolicyStored() { | 137 void DeviceCloudPolicyStoreChromeOS::OnPolicyStored() { |
| 138 UpdateFromService(); | 138 UpdateFromService(); |
| 139 } | 139 } |
| 140 | 140 |
| 141 void DeviceCloudPolicyStoreChromeOS::UpdateFromService() { | 141 void DeviceCloudPolicyStoreChromeOS::UpdateFromService() { |
| 142 const em::PolicyData* policy_data = device_settings_service_->policy_data(); | 142 const em::PolicyData* policy_data = device_settings_service_->policy_data(); |
| 143 const chromeos::DeviceSettingsService::Status status = | 143 const chromeos::DeviceSettingsService::Status status = |
| 144 device_settings_service_->status(); | 144 device_settings_service_->status(); |
| 145 | 145 |
| 146 const bool is_enterprise_managed = install_attributes_->IsEnterpriseDevice(); | 146 const bool is_enterprise_managed = install_attributes_->IsEnterpriseDevice(); |
| 147 bool is_or_was_consumer_managed = false; | 147 if (!is_enterprise_managed) { |
| 148 if (policy_data) { | |
| 149 const ManagementMode management_mode = GetManagementMode(*policy_data); | |
| 150 if (management_mode == MANAGEMENT_MODE_CONSUMER_MANAGED || | |
| 151 (management_mode == MANAGEMENT_MODE_LOCAL_OWNER && | |
| 152 policy() && | |
| 153 GetManagementMode(*policy()) == MANAGEMENT_MODE_CONSUMER_MANAGED)) { | |
| 154 // The device is consumer-managed, or was consumer-managed and is now | |
| 155 // unmanaged. | |
| 156 is_or_was_consumer_managed = true; | |
| 157 } | |
| 158 } | |
| 159 | |
| 160 if (!is_enterprise_managed && !is_or_was_consumer_managed) { | |
| 161 status_ = STATUS_BAD_STATE; | 148 status_ = STATUS_BAD_STATE; |
| 162 NotifyStoreError(); | 149 NotifyStoreError(); |
| 163 return; | 150 return; |
| 164 } | 151 } |
| 165 | 152 |
| 166 // For enterprise devices, once per session, validate internal consistency of | 153 // For enterprise devices, once per session, validate internal consistency of |
| 167 // enrollment state (DM token must be present on enrolled devices) and in case | 154 // enrollment state (DM token must be present on enrolled devices) and in case |
| 168 // of failure set flag to indicate that recovery is required. | 155 // of failure set flag to indicate that recovery is required. |
| 169 if (is_enterprise_managed) { | 156 switch (status) { |
| 170 switch (status) { | 157 case chromeos::DeviceSettingsService::STORE_SUCCESS: |
| 171 case chromeos::DeviceSettingsService::STORE_SUCCESS: | 158 case chromeos::DeviceSettingsService::STORE_KEY_UNAVAILABLE: |
| 172 case chromeos::DeviceSettingsService::STORE_KEY_UNAVAILABLE: | 159 case chromeos::DeviceSettingsService::STORE_NO_POLICY: |
| 173 case chromeos::DeviceSettingsService::STORE_NO_POLICY: | 160 case chromeos::DeviceSettingsService::STORE_INVALID_POLICY: |
| 174 case chromeos::DeviceSettingsService::STORE_INVALID_POLICY: | 161 case chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR: { |
| 175 case chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR: { | 162 if (!enrollment_validation_done_) { |
| 176 if (!enrollment_validation_done_) { | 163 enrollment_validation_done_ = true; |
| 177 enrollment_validation_done_ = true; | 164 const bool has_dm_token = |
| 178 const bool has_dm_token = | 165 status == chromeos::DeviceSettingsService::STORE_SUCCESS && |
| 179 status == chromeos::DeviceSettingsService::STORE_SUCCESS && | 166 policy_data && |
| 180 policy_data && | 167 policy_data->has_request_token(); |
| 181 policy_data->has_request_token(); | |
| 182 | 168 |
| 183 // At the time LoginDisplayHostImpl decides whether enrollment flow is | 169 // At the time LoginDisplayHostImpl decides whether enrollment flow is |
| 184 // to be started, policy hasn't been read yet. To work around this, | 170 // to be started, policy hasn't been read yet. To work around this, |
| 185 // once the need for recovery is detected upon policy load, a flag is | 171 // once the need for recovery is detected upon policy load, a flag is |
| 186 // stored in prefs which is accessed by LoginDisplayHostImpl early | 172 // stored in prefs which is accessed by LoginDisplayHostImpl early |
| 187 // during (next) boot. | 173 // during (next) boot. |
| 188 if (!has_dm_token) { | 174 if (!has_dm_token) { |
| 189 LOG(ERROR) << "Device policy read on enrolled device yields " | 175 LOG(ERROR) << "Device policy read on enrolled device yields " |
| 190 << "no DM token! Status: " << status << "."; | 176 << "no DM token! Status: " << status << "."; |
| 191 chromeos::StartupUtils::MarkEnrollmentRecoveryRequired(); | 177 chromeos::StartupUtils::MarkEnrollmentRecoveryRequired(); |
| 192 } | |
| 193 UMA_HISTOGRAM_BOOLEAN("Enterprise.EnrolledPolicyHasDMToken", | |
| 194 has_dm_token); | |
| 195 } | 178 } |
| 196 break; | 179 UMA_HISTOGRAM_BOOLEAN("Enterprise.EnrolledPolicyHasDMToken", |
| 180 has_dm_token); |
| 197 } | 181 } |
| 198 case chromeos::DeviceSettingsService::STORE_POLICY_ERROR: | 182 break; |
| 199 case chromeos::DeviceSettingsService::STORE_OPERATION_FAILED: | |
| 200 case chromeos::DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR: | |
| 201 // Do nothing for write errors or transient read errors. | |
| 202 break; | |
| 203 } | 183 } |
| 184 case chromeos::DeviceSettingsService::STORE_POLICY_ERROR: |
| 185 case chromeos::DeviceSettingsService::STORE_OPERATION_FAILED: |
| 186 case chromeos::DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR: |
| 187 // Do nothing for write errors or transient read errors. |
| 188 break; |
| 204 } | 189 } |
| 205 | 190 |
| 206 switch (status) { | 191 switch (status) { |
| 207 case chromeos::DeviceSettingsService::STORE_SUCCESS: { | 192 case chromeos::DeviceSettingsService::STORE_SUCCESS: { |
| 208 status_ = STATUS_OK; | 193 status_ = STATUS_OK; |
| 209 policy_.reset(new em::PolicyData()); | 194 policy_.reset(new em::PolicyData()); |
| 210 if (policy_data) | 195 if (policy_data) |
| 211 policy_->MergeFrom(*policy_data); | 196 policy_->MergeFrom(*policy_data); |
| 212 | 197 |
| 213 PolicyMap new_policy_map; | 198 PolicyMap new_policy_map; |
| (...skipping 18 matching lines...) Expand all Loading... |
| 232 case chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR: | 217 case chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR: |
| 233 case chromeos::DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR: | 218 case chromeos::DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR: |
| 234 status_ = STATUS_LOAD_ERROR; | 219 status_ = STATUS_LOAD_ERROR; |
| 235 break; | 220 break; |
| 236 } | 221 } |
| 237 | 222 |
| 238 NotifyStoreError(); | 223 NotifyStoreError(); |
| 239 } | 224 } |
| 240 | 225 |
| 241 } // namespace policy | 226 } // namespace policy |
| OLD | NEW |