Adding a policy for using the uiAccess enabled It2Me binary on Windows

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 06c30b05359da6d6c14ecef963917642e825e0b6..d1a26dee2f6521d6e95e70e7ed7a9245dfaec9d9 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -137,7 +137,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 340
+#   For your editing convenience: highest ID currently used: 342
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -998,6 +998,23 @@
 
           The value is parsed as a JSON dictionary of policy name to policy value mappings.''',
         },
+        {
+          'name': 'RemoteAssistanceHostAllowUiAccess',

[Sergey Ulanov, 2016/08/18 05:55:51]

Many RemoteAccess* policies are applicable for It2Me host as well, so it  may be
confusing that you are adding RemoteAssistance prefix. I would prefer reusing
RemoteAccess prefix for all policies.
Maybe RemoteAccessHostAllowUiAccessForRemoteAssistance or
RemoteAccessHostAssistanceUiAccess

[joedow, 2016/08/18 17:06:07]

I went back and forth on this a bit.  Using the RemoteAccessHost prefix led to a
much longer name than I liked, but I'm fine with it.

+          'type': 'main',
+          'schema': { 'type': 'boolean' },
+          'supported_on': ['chrome.win:54-'],
+          'features': {
+            'dynamic_refresh': False,
+            'per_profile': False,
+          },
+          'example_value': True,
+          'id': 341,
+          'caption': '''Allow remote users to interact with elevated windows in remote assistance sessions''',
+          'tags': [],
+          'desc': '''If this setting is enabled, the remote assistance host will be run in a process with uiAccess permissions.  This will allow remote users to interact with elevated windows on the local user's desktop.

[Thiemo Nagel, 2016/08/18 11:46:17]

What's that uiAccess?  It seems like a non-translatable term, thus please tag
with <ph...> as described at the top of the file.

[joedow, 2016/08/18 17:06:07]

Done.

+
+          If this setting is disabled or not configured, the remote assistance host will run in the user's context and remote users cannot interact with elevated windows on the desktop.''',

[Sergey Ulanov, 2016/08/18 05:55:51]

Can we enable UI access by default?

[joedow, 2016/08/18 17:06:07]

We decided to disable this by default as enabling it will require an additional
dialog for the user to click-through and the decision was to keep the default
flow as simple as possible but expose this setting for Admins and enterprise.

+        },
       ],
     },
     {