Document ARC support for Chrome policies

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 1000 matching lines @@
       },
       'example_value': True,
       'id': 12,
       'caption': '''Enable printing''',
       'tags': [],
       'desc': '''Enables printing in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing this setting.
 
       If this setting is enabled or not configured, users can print.
 
       If this setting is disabled, users cannot print from <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>. Printing is disabled in the wrench menu, extensions, JavaScript applications, etc. It is still possible to print from plugins that bypass <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> while printing. For example, certain Flash applications have the print option in their context menu, which is not covered by this policy.''',
+      'arc_support': 'This policy has no effect on Android apps.',
     },
     {
       'name': 'CloudPrintProxyEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:17-'],
       'features': {
         'dynamic_refresh': True,
         'per_profile': True,
       },
@@ skipping 62 matching lines @@
       },
       'example_value': False,
       'id': 283,
       'caption': '''Force YouTube Safety Mode''',
       'tags': ['filtering'],
       'desc': '''Forces YouTube Safety Mode to active and prevents users from changing this setting.
 
       If you enable this setting, Safety Mode on YouTube is always active.
 
       If you disable this setting or do not set a value, Safety Mode on YouTube is not enforced.''',
+      'arc_support': 'This policy has no effect on the Android YouTube app. If you want to enforce Safety Mode on YouTube, you should disallow installation of the Android YouTube app.',
     },
     {
       'name': 'SafeBrowsingEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:8-', 'chrome_os:11-', 'android:30-'],
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
         'per_profile': True,
@@ skipping 68 matching lines @@
           name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> memorize passwords
           and provide them automatically the next time they log in to a site.
 
           If this settings is disabled, users cannot save new passwords but they
           may still use passwords that have been saved previously.
 
           If this policy is enabled or disabled, users cannot change or override
           it in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>. If this
           policy is unset, password saving is allowed (but can be turned off by
           the user).''',
+          'arc_support': 'This policy has no effect on Android apps.',
         },
         {
           'name': 'PasswordManagerAllowShowPasswords',
           'type': 'main',
           'schema': { 'type': 'boolean' },
           'supported_on': ['chrome.*:8-50', 'chrome_os:11-50'],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
@@ skipping 148 matching lines @@
         'per_profile': True,
       },
       'example_value': True,
       'id': 20,
       'caption': '''Disable synchronization of data with Google''',
       'tags': ['filtering', 'google-sharing'],
       'desc': '''Disables data synchronization in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> using Google-hosted synchronization services and prevents users from changing this setting.
 
       If you enable this setting, users cannot change or override this setting in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
-      If this policy is left not set Google Sync will be available for the user to choose whether to use it or not.''',
+      If this policy is left not set Google Sync will be available for the user to choose whether to use it or not.
+
+      To fully disable Google Sync, it is recommended that you disable the Google Sync service in the Google Admin console.''',
+      'arc_support': 'Disabling Google Sync will cause Android Backup and Restore to not function properly.',
     },
     {
       'name': 'SigninAllowed',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:27-', 'android:38-'],
       'features': {
         'dynamic_refresh': True,
         'per_profile': True,
       },
@@ skipping 135 matching lines @@
       'caption': '''Set download directory''',
       'tags': ['local-data-access'],
       'desc': '''Configures the directory that <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use for downloading files.
 
       If you set this policy, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use the provided directory regardless whether the user has specified one or enabled the flag to be prompted for download location every time.
 
       See https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables for a list of variables that can be used.
 
       If this policy is left not set the default download directory will be used and the user will be able to change it.''',
       'label': '''Set download directory''',
+      'arc_support': 'This policy has no effect on Android apps. Android apps always use the default downloads directory and cannot access any files downloaded by <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> into a non-default downloads directory.',
     },
     {
       'name': 'ClearSiteDataOnExit',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:11-28', 'chrome_os:11-28'],
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
         'per_profile': True,
@@ skipping 26 matching lines @@
       This policy only takes effect if a proxy is configured (for example through policy, by the user in chrome://settings, or by extensions).
 
       If you enable this setting, any captive portal authentication pages (i.e. all web pages starting from captive portal signin page until <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> detects succesful internet connection) will be displayed in a separate window ignoring all policy settings and restrictions for the current user.
 
       If you disable this setting or leave it unset, any captive portal authentication pages will be shown in a (regular) new browser tab, using the current user's proxy settings.''',
     },
     {
       'name': 'Proxy',
       'type': 'group',
       'caption': '''Proxy server''',
-      'desc': '''Allows you to specify the proxy server used by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing proxy settings. ARC-apps will be able to use this proxy server too.
+      'desc': '''Allows you to specify the proxy server used by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing proxy settings.
 
       If you choose to never use a proxy server and always connect directly, all other options are ignored.
 
       If you choose to auto detect the proxy server, all other options are ignored.
 
       For detailed examples, visit:
       <ph name="PROXY_HELP_URL">https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett<ex>https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett</ex></ph>.
 
       If you enable this setting, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and ARC-apps ignore all proxy-related options specified from the command line.
 
@@ skipping 46 matching lines @@
             'ios:34-47',
           ],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': 'direct',
           'id': 21,
           'caption': '''Choose how to specify proxy server settings''',
           'tags': [],
-          'desc': '''Allows you to specify the proxy server used by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing proxy settings. ARC-apps will be able to use this proxy server too.
+          'desc': '''Allows you to specify the proxy server used by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing proxy settings.
 
           If you choose to never use a proxy server and always connect directly, all other options are ignored.
 
           If you choose to use system proxy settings, all other options are ignored.
 
           If you choose to auto detect the proxy server, all other options are ignored.
 
           If you choose fixed server proxy mode, you can specify further options in 'Address or URL of proxy server' and 'Comma-separated list of proxy bypass rules'. Only the HTTP proxy server with the highest priority is available for ARC-apps.
 
           If you choose to use a .pac proxy script, you must specify the URL to the script in 'URL to a proxy .pac file'.
 
           For detailed examples, visit:
           <ph name="PROXY_HELP_URL">https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett<ex>https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett</ex></ph>.
 
           If you enable this setting, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and ARC-apps ignore all proxy-related options specified from the command line.
 
           Leaving this policy not set will allow the users to choose the proxy settings on their own.''',
+          'arc_support': 'Only a subset of proxy configuration options are made available to Android apps. Android apps may voluntarily choose to use the proxy. You cannot force them to use a proxy.',

[phweiss, 2016/08/26 16:30:17]

"Only a subset" -> Can we give more details on what subset? Or on how the admin
can find out?

[bartfab (slow), 2016/08/29 12:25:36]

Done. Thanks for nagging. I was being lazy :).

         },
         {
           'name': 'ProxyServerMode',
           'type': 'int-enum',
           'schema': {
             'type': 'integer',
             'enum': [ 0, 1, 2, 3 ],
           },
           'items': [
             {
@@ skipping 27 matching lines @@
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'deprecated': True,
           'example_value': 2,
           'id': 22,
           'caption': '''Choose how to specify proxy server settings''',
           'tags': [],
           'desc': '''This policy is deprecated, use ProxyMode instead.
 
-          Allows you to specify the proxy server used by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing proxy settings. ARC-apps will be able to use this proxy server too.
+          Allows you to specify the proxy server used by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing proxy settings.
 
           If you choose to never use a proxy server and always connect directly, all other options are ignored.
 
           If you choose to use system proxy settings or auto detect the proxy server, all other options are ignored.
 
           If you choose manual proxy settings, you can specify further options in 'Address or URL of proxy server', 'URL to a proxy .pac file' and 'Comma-separated list of proxy bypass rules'. Only the HTTP proxy server with the highest priority is available for ARC-apps.
 
           For detailed examples, visit:
           <ph name="PROXY_HELP_URL">https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett<ex>https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett</ex></ph>.
 
           If you enable this setting, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> ignores all proxy-related options specified from the command line.
 
           Leaving this policy not set will allow the users to choose the proxy settings on their own.''',
+          'arc_support': 'Only a subset of proxy configuration options are made available to Android apps. Android apps may voluntarily choose to use the proxy. You cannot force them to use a proxy.',
         },
         {
           'name': 'ProxyServer',
           'type': 'string',
           'schema': { 'type': 'string' },
           'supported_on': [
             'chrome.*:8-',
             'chrome_os:11-',
             'android:30-',
             'ios:34-47',
           ],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': '123.123.123.123:8080',
           'id': 23,
           'caption': '''Address or URL of proxy server''',
           'tags': [],
           'desc': '''You can specify the URL of the proxy server here.
 
           This policy only takes effect if you have selected manual proxy settings at 'Choose how to specify proxy server settings'.
 
           You should leave this policy not set if you have selected any other mode for setting proxy policies.
 
           For more options and detailed examples, visit:
           <ph name="PROXY_HELP_URL">https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett<ex>https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett</ex></ph>.''',
+          'arc_support': 'Only a subset of proxy configuration options are made available to Android apps. Android apps may voluntarily choose to use the proxy. You cannot force them to use a proxy.',
         },
         {
           'name': 'ProxyPacUrl',
           'type': 'string',
           'schema': { 'type': 'string' },
           'supported_on': [
             'chrome.*:8-',
             'chrome_os:11-',
             'android:30-',
             'ios:34-47',
           ],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': 'https://internal.site/example.pac',
           'id': 24,
           'caption': '''URL to a proxy .pac file''',
           'tags': [],
           'desc': '''You can specify a URL to a proxy .pac file here.
 
           This policy only takes effect if you have selected manual proxy settings at 'Choose how to specify proxy server settings'.
 
           You should leave this policy not set if you have selected any other mode for setting proxy policies.
 
           For detailed examples, visit:
           <ph name="PROXY_HELP_URL">https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett<ex>https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett</ex></ph>.''',
+          'arc_support': 'Only a subset of proxy configuration options are made available to Android apps. Android apps may voluntarily choose to use the proxy. You cannot force them to use a proxy.',
         },
         {
           'name': 'ProxyBypassList',
           'type': 'string',
           'schema': { 'type': 'string' },
           'supported_on': [
             'chrome.*:8-',
             'chrome_os:11-',
             'android:30-',
             'ios:34-47',
           ],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': 'https://www.example1.com,https://www.example2.com,https://internalsite/',
           'id': 25,
           'caption': '''Proxy bypass rules''',
           'tags': [],
-          'desc': '''<ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will bypass any proxy for the list of hosts given here. ARC-apps will be able to use this list as a bypass rules list.
+          'desc': '''<ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will bypass any proxy for the list of hosts given here.
 
           This policy only takes effect if you have selected manual proxy settings at 'Choose how to specify proxy server settings'.
 
           You should leave this policy not set if you have selected any other mode for setting proxy policies.
 
           For more detailed examples, visit:
           <ph name="PROXY_HELP_URL">https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett<ex>https://www.chromium.org/developers/design-documents/network-settings#TOC-Command-line-options-for-proxy-sett</ex></ph>.''',
           'label': '''Comma-separated list of proxy bypass rules''',
+          'arc_support': 'Only a subset of proxy configuration options are made available to Android apps. Android apps may voluntarily choose to use the proxy. You cannot force them to use a proxy.',
         },
       ],
     },
     {
       # TODO(joaodasilva): Make this the default and deprecate the other proxy
       # policies once all providers are ready to load 'dict' policies.
       # This is currently an internal policy.
       # https://crbug.com/108992, https://crbug.com/108996
       'name': 'ProxySettings',
       'type': 'dict',
@@ skipping 18 matching lines @@
         'dynamic_refresh': True,
         'per_profile': True,
       },
       'example_value': { "ProxyMode": "direct" },
       'id': 116,
       'caption': '''Proxy settings''',
       'tags': ['system-security'],
       'desc': '''Configures the proxy settings for <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>. These proxy settings will be available for ARC-apps too.
 
       This policy isn't ready for usage yet, please don't use it.''',
+      'arc_support': 'Only a subset of proxy configuration options are made available to Android apps. Android apps may voluntarily choose to use the proxy. You cannot force them to use a proxy.',
     },
     {
       'name': 'HTTPAuthentication',
       'type': 'group',
       'caption': '''Policies for HTTP authentication''',
       'desc': '''Policies related to integrated HTTP authentication.''',
       'policies': [
         {
           'name': 'AuthSchemes',
           'type': 'string',
@@ skipping 252 matching lines @@
           name="EXTENSION_POLICY_EXAMPLE">gbchcmhmhahfdphkhkmpfmihenigjmpp;https://clients2.google.com/service/update2/crx</ph>
           installs the <ph name="EXTENSION_POLICY_EXAMPLE_EXTENSION_NAME">Chrome
           Remote Desktop</ph> app from the standard Chrome Web Store "update"
           URL. For more information about hosting extensions, see: <ph
           name="LINK_TO_EXTENSION_DOC2">https://developer.chrome.com/extensions/hosting</ph>.
 
           If this policy is left not set, no apps or extensions are installed
           automatically and the user can uninstall any app or extension in <ph
           name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.''',
           'label': '''Extension/App IDs and update URLs to be silently installed''',
+          'arc_support': 'Android apps can be force-installed from the Google Admin console using Google Play. They do not use this policy.',
         },
         {
           'name': 'ExtensionInstallSources',
           'type': 'list',
           'schema': {
             'type': 'array',
             'items': { 'type': 'string' },
             'id': 'ExtensionInstallSources',
           },
           'supported_on': ['chrome.*:21-', 'chrome_os:21-'],
@@ skipping 219 matching lines @@
         'per_profile': True,
       },
       'example_value': False,
       'id': 36,
       'caption': '''Disable Developer Tools''',
       'tags': [],
       'desc': '''Disables the Developer Tools and the JavaScript console.
 
       If you enable this setting, the Developer Tools can not be accessed and web-site elements can not be inspected anymore. Any keyboard shortcuts and any menu or context menu entries to open the Developer Tools or the JavaScript Console will be disabled.
 
-      Setting this option to disabled or leaving it not set will allow the use to use the Developer Tools and the JavaScript console.
-
-      For <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> devices capable of running Android apps, this policy also controls access to Android Developer Options. If you set this policy to true, users cannot access Developer Options. If you set this policy to false or leave it unset, users can access Developer Options by tapping seven times on the build number in the Android settings app.''',
+      Setting this option to disabled or leaving it not set will allow the use to use the Developer Tools and the JavaScript console.''',
+      'arc_support': 'This policy also controls access to Android Developer Options. If you set this policy to true, users cannot access Developer Options. If you set this policy to false or leave it unset, users can access Developer Options by tapping seven times on the build number in the Android settings app.',
     },
     {
       'name': 'RestoreOnStartupGroup',
       'type': 'group',
       'caption': '''Startup pages''',
       'desc': '''Allows you to configure the pages that are loaded on startup.
 
       The contents of the list 'URLs to open at startup' are ignored unless you select 'Open a list of URLs' in 'Action on startup'.''',
       'policies': [
         {
@@ skipping 702 matching lines @@
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': 0,
           'id': 54,
           'caption': '''Default geolocation setting''',
           'tags': ['website-sharing'],
           'desc': '''Allows you to set whether websites are allowed to track the users' physical location. Tracking the users' physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location.
 
-          If this policy is set to 'BlockGeolocation', location sharing is disallowed for ARC apps.
-
           If this policy is left not set, 'AskGeolocation' will be used and the user will be able to change it.''',
+          'arc_support': 'If this policy is set to <ph name="BLOCK_GEOLOCATION_SETTING">BlockGeolocation</ph>, Android apps cannot access location information. If you set this policy to any other value or leave it unset, the user is asked to consent when an Android app tries to access location information.',

[phweiss, 2016/08/26 16:30:16]

The admin is giving the consent when they approve the app for the domain in the
playstore, I do not think that the user needs to be asked again (of course, some
apps contain a switch to turn location features off).

[bartfab (slow), 2016/08/29 12:25:36]

As just checked offline, we actually do show the permission dialog to the user.

         },
         {
           'name': 'DefaultMediaStreamSetting',
           'type': 'int-enum',
           'schema': {
             'type': 'integer',
             'enum': [ 2, 3 ],
           },
           'items': [
             {
@@ skipping 402 matching lines @@
             'can_be_recommended': True,
             'can_be_mandatory' : False,
           },
           'example_value': [{'protocol': 'mailto', 'url': 'https://mail.google.com/mail/?extsrc=mailto&url=%s', 'default': True}],
           'id': 268,
           'caption': '''Register protocol handlers''',
           'tags': [],
           'desc': '''Allows you to register a list of protocol handlers. This can only be a recommended policy. The property |protocol| should be set to the scheme such as 'mailto' and the property |url| should be set to the URL pattern of the application that handles the scheme. The pattern can include a '%s', which if present will be replaced by the handled URL.
 
           The protocol handlers registered by policy are merged with the ones registered by the user and both are available for use. The user can override the protocol handlers installed by policy by installing a new default handler, but cannot remove a protocol handler registered by policy.''',
+          'arc_support': 'The protocol handlers set via this policy are not used when handling Android intents.',
         },
         {
           'name': 'PopupsBlockedForUrls',
           'type': 'list',
           'schema': {
             'type': 'array',
             'items': { 'type': 'string' },
           },
           'supported_on': [
             'chrome.*:11-',
@@ skipping 414 matching lines @@
 
       If this policy is set to 'MultiProfileUserBehaviorMustBePrimary', the user can only be the primary user in a multiprofile session.
 
       If this policy is set to 'MultiProfileUserBehaviorNotAllowed', the user cannot be part of a multiprofile session.
 
       If you set this setting, users cannot change or override it.
 
       If the setting is changed while the user is signed into a multiprofile session, all users in the session will be checked against their corresponding settings. The session will be closed if any one of the users is no longer allowed to be in the session.
 
       If the policy is left not set, the default value 'MultiProfileUserBehaviorMustBePrimary' applies for enterprise-managed users and 'MultiProfileUserBehaviorUnrestricted' will be used for non-managed users.''',
+      'arc_support': 'When multiple users are logged in, only the primary user can use Android apps.',
     },
     {
       'name': 'InstantEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:11-28', 'chrome_os:11-28'],
       'deprecated': True,
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
@@ skipping 400 matching lines @@
 
       This policy prevents the user from loading web pages from blacklisted URLs. The blacklist provides a list of URL patterns that specify which URLs will be blacklisted.
 
       A URL pattern has to be formatted according to https://www.chromium.org/administrators/url-blacklist-filter-format.
 
       Exceptions can be defined in the URL whitelist policy. These policies are limited to 1000 entries; subsequent entries will be ignored.
 
       Note that it is not recommended to block internal 'chrome://*' URLs since this may lead to unexpected errors.
 
       If this policy is not set no URL will be blacklisted in the browser.''',
+      'arc_support': 'Android apps may voluntarily choose to honor this list. You cannot force them to honor it.',
     },
     {
       'name': 'URLWhitelist',
       'type': 'list',
       'schema': {
         'type': 'array',
         'items': { 'type': 'string' },
       },
       'supported_on': [
         'chrome.*:15-',
@@ skipping 14 matching lines @@
 
       See the description of the URL blacklist policy for the format of entries of this list.
 
       This policy can be used to open exceptions to restrictive blacklists. For example, '*' can be blacklisted to block all requests, and this policy can be used to allow access to a limited list of URLs. It can be used to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths.
 
       The most specific filter will determine if a URL is blocked or allowed. The whitelist takes precedence over the blacklist.
 
       This policy is limited to 1000 entries; subsequent entries will be ignored.
 
       If this policy is not set there will be no exceptions to the blacklist from the 'URLBlacklist' policy.''',
+      'arc_support': 'Android apps may voluntarily choose to honor this list. You cannot force them to honor it.',
     },
     {
       'name': 'OpenNetworkConfiguration',
       'type': 'string',
       'schema': { 'type': 'string' },
       'supported_on': ['chrome_os:16-'],
       'features': {
         'dynamic_refresh': True,
         'per_profile': True,
       },
       'example_value': '{ "NetworkConfigurations": [ { "GUID": "{4b224dfd-6849-7a63-5e394343244ae9c9}", "Name": "my WiFi", "Type": "WiFi", "WiFi": { "SSID": "my WiFi", "HiddenSSID": false, "Security": "None", "AutoConnect": true } } ] }',
       'id': 107,
       'caption': '''User-level network configuration''',
       'tags': ['full-admin-access'],
       'desc': '''Allows pushing network configuration to be applied per-user to a <ph name="PRODUCT_OS_NAME">$2<ex>Chromium OS</ex></ph> device. The network configuration is a JSON-formatted string as defined by the Open Network Configuration format described at <ph name="ONC_SPEC_URL">https://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/open-network-configuration</ph>''',
+      'arc_support': 'Android apps can use the network configurations and CA certificates set via this policy, but do not have access to some configuration options.',

[phweiss, 2016/08/26 16:30:16]

"some configuration options" -> Same question as on "some subset" above.

[bartfab (slow), 2016/08/29 12:25:36]

Most ONC options are consumed by the host OS and will just work. But there are a
few (e.g. proxies) which we would need to investigate before we can document
whether they work or not. Since we are not sure right now, sadly, a vague
statement like the above is the best we can do.

I filed b/31145471 to investigate this in the future.

     },
     {
       'name': 'DeviceOpenNetworkConfiguration',
       'type': 'string',
       'schema': { 'type': 'string' },
       'supported_on': ['chrome_os:16-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': '{ "NetworkConfigurations": [ { "GUID": "{4b224dfd-6849-7a63-5e394343244ae9c9}", "Name": "my WiFi", "Type": "WiFi", "WiFi": { "SSID": "my WiFi", "HiddenSSID": false, "Security": "None", "AutoConnect": true } } ] }',
       'id': 108,
       'caption': '''Device-level network configuration''',
       'tags': ['full-admin-access'],
       'desc': '''Allows pushing network configuration to be applied for all users of a <ph name="PRODUCT_OS_NAME">$2<ex>Chromium OS</ex></ph> device. The network configuration is a JSON-formatted string as defined by the Open Network Configuration format described at <ph name="ONC_SPEC_URL">https://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/open-network-configuration</ph>''',
+      'arc_support': 'Android apps can use the network configurations and CA certificates set via this policy, but do not have access to some configuration options.',
     },
     {
       'name': 'CloudPrintSubmitEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:17-'],
       'features': {
         'dynamic_refresh': True,
         'per_profile': True,
       },
@@ skipping 139 matching lines @@
           "namePattern": {
             "description": "Regular expression to match printer display name.",
             "type": "string"
           }
         }
       }
 
       Printers connected to <ph name="CLOUD_PRINT_NAME">Google Cloud Print</ph> are considered <ph name="PRINTER_TYPE_CLOUD">"cloud"</ph>, the rest of the printers are classified as <ph name="PRINTER_TYPE_LOCAL">"local"</ph>.
       Omitting a field means all values match, for example, not specifying connectivity will cause Print Preview to initiate the discovery of all kinds of printers, local and cloud.
       Regular expression patterns must follow the JavaScript RegExp syntax and matches are case sensistive.''',
+      'arc_support': 'This policy has no effect on Android apps.',
     },
     {
       'name': 'DisableSSLRecordSplitting',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:18-46', 'chrome_os:18-46'],
       'features': {
         'dynamic_refresh': True,
         'per_profile': False,
       },
@@ skipping 154 matching lines @@
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 119,
       'caption': '''Report OS and firmware version''',
       'tags': ['admin-sharing'],
       'desc': '''Report OS and firmware version of enrolled devices.
 
       If this setting is not set or set to True, enrolled devices will report the OS and firmware version periodically. If this setting is set to False, version info will not be reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceActivityTimes',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:18-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 120,
       'caption': '''Report device activity times''',
       'tags': ['admin-sharing'],
       'desc': '''Report device activity times.
 
       If this setting is not set or set to True, enrolled devices will report time periods when a user is active on the device. If this setting is set to False, device activity times will not be recorded or reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceBootMode',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:18-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 121,
       'caption': '''Report device boot mode''',
       'tags': ['admin-sharing'],
       'desc': '''Report the state of the device's dev switch at boot.
 
       If the policy is set to false, the state of the dev switch will not be reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceLocation',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:20-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'future': True,
       'example_value': False,
       'id': 143,
       'caption': '''Report device location''',
       'tags': ['admin-sharing'],
       'desc': '''Report the geographic location of the device.
 
       If the policy is not set, or set to false, the location will not be reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceNetworkInterfaces',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:29-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 224,
       'caption': '''Report device network interfaces''',
       'tags': ['admin-sharing'],
       'desc': '''Report list of network interfaces with their types and hardware addresses to the server.
 
       If the policy is set to false, the interface list will not be reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceUsers',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:32-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 248,
       'caption': '''Report device users''',
       'tags': ['admin-sharing'],
       'desc': '''Report list of device users that have recently logged in.
 
       If the policy is set to false, the users will not be reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceHardwareStatus',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:42-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 290,
       'caption': '''Report hardware status''',
       'tags': ['admin-sharing'],
       'desc': '''Report hardware statistics such as CPU/RAM usage.
 
       If the policy is set to false, the statistics will not be reported.
       If set to true or left unset, statistics will be reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportDeviceSessionStatus',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:42-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 291,
       'caption': '''Report information about active kiosk sessions''',
       'tags': ['admin-sharing'],
       'desc': '''Report information about the active kiosk session, such as
       application ID and version.
 
       If the policy is set to false, the session information will not be
       reported. If set to true or left unset, session information will be
       reported.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'ReportUploadFrequency',
       'type': 'int',
       'schema': { 'type': 'integer', 'minimum': 60000 },
       'supported_on': ['chrome_os:42-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': 180000,
       'id': 292,
       'caption': '''Frequency of device status report uploads''',
       'tags': ['admin-sharing'],
       'desc': '''How frequently device status uploads are sent, in milliseconds.
 
       If this policy is unset, the default frequency is 3 hours. The minimum
       allowed frequency is 60 seconds.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'HeartbeatEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:43-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 293,
       'caption': '''Send network packets to the management server to monitor online status''',
       'tags': ['admin-sharing'],
       'desc': '''Send network packets to the management server to monitor online status, to allow
       the server to detect if the device is offline.
 
       If this policy is set to true, monitoring network packets (so-called <ph name="HEARTBEATS_TERM">heartbeats</ph>) will be sent.
       If set to false or unset, no packets will be sent.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'HeartbeatFrequency',
       'type': 'int',
       'schema': { 'type': 'integer', 'minimum': 30000 },
       'supported_on': ['chrome_os:43-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': 180000,
       'id': 294,
       'caption': '''Frequency of monitoring network packets''',
       'tags': [],
       'desc': '''How frequently monitoring network packets are sent, in milliseconds.
 
       If this policy is unset, the default frequency is 3 minutes. The minimum
       frequency is 30 seconds and the maximum frequency is 24 hours - values
       outside of this range will be clamped to this range.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'LogUploadEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:46-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': False,
       'id': 306,
       'caption': '''Send system logs to the management server''',
       'tags': [],
       'desc': '''Send system logs to the management server, to allow
       admins to monitor system logs.
 
       If this policy is set to true, system logs will be sent. If set
       to false or unset, then no system logs will be sent.''',
+      'arc_support': 'This policy has no effect on the logging done by Android.',
     },
     {
       'name': 'DeviceUserWhitelist',
       'type': 'list',
       'schema': {
         'type': 'array',
         'items': { 'type': 'string' },
       },
       'supported_on': ['chrome_os:12-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': [ 'madmax@managedchrome.com' ],
       'id': 122,
       'caption': '''Login user white list''',
       'tags': [],
       'desc': '''Defines the list of users that are allowed to login to the device. Entries are of the form <ph name="USER_WHITELIST_ENTRY_FORMAT">user@domain</ph>, such as <ph name="USER_WHITELIST_ENTRY_EXAMPLE">madmax@managedchrome.com</ph>. To allow arbitrary users on a domain, use entries of the form <ph name="USER_WHITELIST_ENTRY_WILDCARD">*@domain</ph>.
 
       If this policy is not configured, there are no restrictions on which users are allowed to sign in. Note that creating new users still requires the <ph name="DEVICEALLOWNEWUSERS_POLICY_NAME">DeviceAllowNewUsers</ph> policy to be configured appropriately.''',
+      'arc_support': 'This policy controls who may start a <ph name="PRODUCT_OS_NAME">$2<ex>Chromium OS</ex></ph> session. It does not prevent users from signing in to additional Google accounts within Android. If you want to prevent this, configure the Android-specific <ph name="CLOUDDPC_ACCOUNT_MANAGEMENT_POLICY">accountTypesWithManagementDisabled</ph> policy as part of <ph name="ARC_POLICY">ArcPolicy</ph>.',
     },
     {
       'name': 'DeviceAllowNewUsers',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:12-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': True,
       'id': 123,
       'caption': '''Allow creation of new user accounts''',
       'tags': [],
       'desc': '''Controls whether <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> allows new user accounts to be created. If this policy is set to false, users that do not have an account already will not be able to login.
 
       If this policy is set to true or not configured, new user accounts will be allowed to be created provided that <ph name="DEVICEUSERWHITELISTPROTO_POLICY_NAME">DeviceUserWhitelist</ph> does not prevent the user from logging in.''',
+      'arc_support': 'This policy controls whether new users can be added to <ph name="PRODUCT_OS_NAME">$2<ex>Chromium OS</ex></ph>. It does not prevent users from signing in to additional Google accounts within Android. If you want to prevent this, configure the Android-specific <ph name="CLOUDDPC_ACCOUNT_MANAGEMENT_POLICY">accountTypesWithManagementDisabled</ph> policy as part of <ph name="ARC_POLICY">ArcPolicy</ph>.',
     },
     {
       'name': 'DeviceGuestModeEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:12-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
@@ skipping 42 matching lines @@
       'supported_on': ['chrome_os:14-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': True,
       'id': 127,
       'caption': '''Enable metrics reporting''',
       'tags': ['admin-sharing'],
       'desc': '''Controls whether usage metrics are reported back to Google. If set to true, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> will report usage metrics. If not configured or set to false, metrics reporting will be disabled.''',
+      'arc_support': 'This policy also controls Android usage and diagnostic data collection.',
     },
     {
       'name': 'ChromeOsReleaseChannel',
       'type': 'string-enum',
       'schema': {
         'type': 'string',
         'enum': [ 'stable-channel', 'beta-channel', 'dev-channel' ],
       },
       'items': [
         {
@@ skipping 389 matching lines @@
         'dynamic_refresh': True,
       },
       'example_value': True,
       'id': 266,
       'caption': '''Block developer mode''',
       'tags': [],
       'desc': '''Block developer mode.
 
       If this policy is set to True, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> will prevent the device from booting into developer mode. The system will refuse to boot and show an error screen when the developer switch is turned on.
 
-      If this policy is unset or set to False, developer mode will remain available for the device.'''
+      If this policy is unset or set to False, developer mode will remain available for the device.''',
+      'arc_support': 'This policy controls <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> developer mode only. If you want to prevent access to Android Developer Options, you need to set the <ph name="DEVELOPER_TOOLS_POLICY">DeveloperToolsDisabled</ph> policy.',
     },
     {
       'name': 'BackgroundModeEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.win:19-', 'chrome.linux:19-'],
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
         'per_profile': False,
@@ skipping 25 matching lines @@
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': True,
           'id': 139,
           'caption': '''Disables Drive in the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> Files app''',
           'tags': [],
           'desc': '''Disables Google Drive syncing in the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> Files app when set to True. In that case, no data is uploaded to Google Drive.
 
           If not set or set to False, then users will be able to transfer files to Google Drive.''',
+          'arc_support': 'This policy does not prevent the user from using the Android Google Drive app. If you want to prevent access to Google Drive, you should disallow installation of the Android Google Drive app as well.',
         },
         {
           'name': 'DriveDisabledOverCellular',
           'type': 'main',
           'schema': { 'type': 'boolean' },
           'supported_on': ['chrome_os:19-'],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': True,
           'id': 140,
           'caption': '''Disables Google Drive over cellular connections in the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> Files app''',
           'tags': [],
           'desc': '''Disables Google Drive syncing in the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> Files app when using a cellular connection when set to True. In that case, data is only synced to Google Drive when connected via WiFi or Ethernet.
 
           If not set or set to False, then users will be able to transfer files to Google Drive via cellular connections.''',
+          'arc_support': 'This policy has no effect on the Android Google Drive app. If you want to prevent use of Google Drive over cellular connections, you should disallow installation of the Android Google Drive app.',
         },
       ],
     },
     {
       'name': 'PinnedLauncherApps',
       'type': 'list',
       'schema': {
         'type': 'array',
         'items': { 'type': 'string' },
       },
@@ skipping 97 matching lines @@
       'id': 152,
       'caption': '''Disable mounting of external storage''',
       'tags': [],
       'desc': '''Disable mounting of external storage.
 
       When this policy is set to true, external storage will not be available in the file browser.
 
       This policy affects all types of storage media. For example: USB flash drives, external hard drives, SD and other memory cards, optical storage etc. Internal storage is not affected, therefore files saved in the Download folder can still be accessed. Google Drive is also not affected by this policy.
 
       If this setting is disabled or not configured then users can use all supported types of external storage on their device.''',
+

[phweiss, 2016/08/26 16:30:17]

Remove empty line?

[bartfab (slow), 2016/08/29 12:25:36]

Done.

     },
     {
       'name': 'ExternalStorageReadOnly',
       'id': 343,
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'tags': [],
       'supported_on': ['chrome_os:54-'],
       'caption': '''Treat external storage devices as read-only.''',
       'desc': '''When this policy is set to true, users cannot write anything to external storage devices.''',
@@ skipping 38 matching lines @@
       'caption': '''Allow or deny audio capture''',
       'tags': [],
       'desc': '''Allow or deny audio capture.
 
       If enabled or not configured (default), the user will be prompted for
       audio capture access except for URLs configured in the
       AudioCaptureAllowedUrls list which will be granted access without prompting.
 
       When this policy is disabled, the user will never be prompted and audio
       capture only be available to URLs configured in AudioCaptureAllowedUrls.
-      For ARC apps, the microphone is permanently muted.
 
       This policy affects all types of audio inputs and not only the built-in microphone.''',
+      'arc_support': 'For Android apps, this policy affects the microphone only. When this policy is set to true, the microphone is muted for all Android apps, with no exceptions.',
     },
     {
       'name': 'AudioCaptureAllowedUrls',
       'type': 'list',
       'schema': {
         'type': 'array',
         'items': { 'type': 'string' },
       },
       'supported_on': ['chrome.*:29-', 'chrome_os:29-'],
       'features': {
@@ skipping 21 matching lines @@
       },
       'example_value': False,
       'id': 167,
       'caption': '''Allow or deny video capture''',
       'tags': [],
       'desc': '''Allow or deny video capture.
 
       If enabled or not configured (default), the user will be prompted for
       video capture access except for URLs configured in the
       VideoCaptureAllowedUrls list which will be granted access without prompting.
-      ARC apps will be able to access the camera if they have been given
-      permission.
 
       When this policy is disabled, the user will never be prompted and video
       capture only be available to URLs configured in VideoCaptureAllowedUrls.
-      ARC apps will not be able to access the camera.
 
-      Outside of ARC-apps, this policy affects all types of video inputs and
-      not only the built-in camera.''',
+      This policy affects all types of video inputs and not only the built-in camera.''',
+      'arc_support': 'For Android apps, this policy affects the built-in camera only. When this policy is set to true, the camera is disabled for all Android apps, with no exceptions.',
     },
     {
       'name': 'VideoCaptureAllowedUrls',
       'type': 'list',
       'schema': {
         'type': 'array',
         'items': { 'type': 'string' },
       },
       'supported_on': ['chrome.*:29-', 'chrome_os:29-'],
       'features': {
@@ skipping 19 matching lines @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
       'example_value': True,
       'id': 153,
       'caption': '''Disable taking screenshots''',
       'tags': [],
       'desc': '''Disables taking screenshots.
 
       If enabled screenshots cannot be taken using keyboard shortcuts or extension APIs.
-      Additionally, screen capture is disabled for ARC apps.
 
       If disabled or not specified, taking screenshots is allowed.'''
     },

[phweiss, 2016/08/26 16:30:16]

If this policy is set, CloudDPC's screenCaptureDisabled is set, this should also
be documented.

[bartfab (slow), 2016/08/29 12:25:36]

Our default assumption is that non-browser-specific policies apply to Android
apps unless stated otherwise. This policy works the expected way, so no need to
document it.

     {
       'name': 'SystemTimezone',
       'type': 'string',
       'schema': { 'type': 'string' },
       'supported_on': ['chrome_os:22-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
       'example_value': 'America/Los_Angeles',
@@ skipping 694 matching lines @@
           },
           'example_value': True,
           'id': 183,
           'caption': '''Specify whether video activity affects power management''',
           'tags': [],
           'desc': '''Specifies whether video activity affects power management.
 
           If this policy is set to True or is unset, the user is not considered to be idle while video is playing. This prevents the idle delay, screen dim delay, screen off delay and screen lock delay from being reached and the corresponding actions from being taken.
 
           If this policy is set to False, video activity does not prevent the user from being considered idle.''',
+          'arc_support': 'Video playing in Android apps is not taken into consideration, even if this policy is set to <ph name="TRUE">True</ph>.',
         },
         {
           'name': 'PresentationIdleDelayScale',
           'type': 'int',
           'schema': { 'type': 'integer' },
           'supported_on': ['chrome_os:26-28'],
           'features': {
             'dynamic_refresh': True,
             'per_profile': False,
           },
@@ skipping 1271 matching lines @@
       'tags': [],
       'desc': '''Specifies whether authentication cookies set by a SAML IdP during login should be transferred to the user's profile.
 
       When a user authenticates via a SAML IdP during login, cookies set by the IdP are written to a temporary profile at first. These cookies can be transferred to the user's profile to carry forward the authentication state.
 
       When this policy is set to true, cookies set by the IdP are transferred to the user's profile every time they authenticate against the SAML IdP during login.
 
       When this policy is set to false or unset, cookies set by the IdP are transferred to the user's profile during their first login on a device only.
 
       This policy affects users whose domain matches the device's enrollment domain only. For all other users, cookies set by the IdP are transferred to the user's profile during their first login on the device only.''',
+      'arc_support': 'Cookies transferred to the user\'s profile are not accessible to Android apps.',
     },
     {
       'name': 'EasyUnlockAllowed',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome_os:38-'],
       'features': {
         'dynamic_refresh': True,
         'per_profile': True,
       },
@@ skipping 304 matching lines @@
       'device_only': True,
       'features': {
         'dynamic_refresh': False,
       },
       'example_value': 104857600,
       'id': 296,
       'caption': '''Set Apps and Extensions cache size (in bytes)''',
       'tags': [],
       'desc': '''<ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> caches Apps and Extensions for installation by multiple users of a single device to avoid re-downloading them for each user.
       If this policy is not configured or the value is lower than 1 MB, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> will use the default cache size.''',
+      'arc_support': 'The cache is not used for Android apps. If multiple users install the same Android app, it will be downloaded anew for each user.',
     },
     {
       'name': 'DeviceLoginScreenDomainAutoComplete',
       'type': 'string',
       'schema': { 'type': 'string' },
       'supported_on': [ 'chrome_os:44-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
       },
@@ skipping 85 matching lines @@
       'tags': [],
       'desc': '''Grants access to corporate keys to extensions.
 
       Keys are designated for corporate usage if they're generated using the chrome.enterprise.platformKeys API on a managed account. Keys imported or generated in another way are not designated for corporate usage.
 
       Access to keys designated for corporate usage is solely controlled by this policy. The user can neither grant nor withdraw access to corporate keys to or from extensions.
 
       By default an extension cannot use a key designated for corporate usage, which is equivalent to setting allowCorporateKeyUsage to false for that extension.
 
       Only if allowCorporateKeyUsage is set to true for an extension, it can use any platform key marked for corporate usage to sign arbitrary data. This permission should only be granted if the extension is trusted to secure access to the key against attackers.''',
+      'arc_support': 'Android apps cannot get access to corporate keys. This policy has no effect on them.',
     },
     {
       'name': 'WelcomePageOnOSUpgradeEnabled',
       'supported_on': ['chrome.win:45-'],
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'id': 303,
       'caption': 'Enable showing the welcome page on the first browser launch following OS upgrade.',
       'tags': [],
       'desc': '''Enable showing the welcome page on the first browser launch following OS upgrade.
@@ skipping 152 matching lines @@
       'id': 319,
       'caption': '''Allow the auto launched with zero delay kiosk app to control <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> version''',
       'tags': [],
       'desc': '''Whether to allow the auto launched with zero delay kiosk app to control <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> version.
 
       This policy controls whether to allow the auto launched with zero delay kiosk app to control <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> version by declaring a required_platform_version in its manifest and use it as the auto update target version prefix.
 
       If the policy is set to true, the value of required_platform_version manifest key of the auto launched with zero delay kiosk app is used as auto update target version prefix.
 
       If the policy is not configured or set to false, the required_platform_version manifest key is ignored and auto update proceeds as normal.''',
+      'arc_support': 'If the kiosk app is an Android app, it will have no control over the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> version, even if this policy is set to <ph name="TRUE">True</ph>.',
     },
     {
       'name': 'LoginAuthenticationBehavior',
       'type': 'int-enum',
       'schema': {
         'type': 'integer',
         'enum': [ 0, 1, 2 ],
       },
       'items': [
         {
@@ skipping 527 matching lines @@
       'text': '''until version <ph name="UNTIL_VERSION">$6<ex>10</ex></ph>'''
     },
     'doc_supported_features': {
       'desc': '''Caption text of the list of 'policy features that this policy supports' in the summary chart of a policy in the generated documentation''',
       'text': '''Supported features:'''
     },
     'doc_description': {
       'desc': '''Caption text of the 'description text' in the summary chart of a policy in the generated documentation''',
       'text': '''Description:'''
     },
+    'doc_arc_support': {

[phweiss, 2016/08/26 16:30:16]

"doc_arc_support" does not seem to be used outside the unittest.

[flackr, 2016/08/26 17:50:57]

If I understand correctly, this is the shared caption for all of the above
arc_support messages.

[bartfab (slow), 2016/08/29 12:25:36]

Yes, this is consumed internally by grit. There is a method in there that will
concatenate "doc_" with "arc_support" to construct the key required to access
this string.

+      'desc': '''Caption text of the field in the generated documentation that describes how a policy affects Android applications on Chrome OS''',
+      'text': '''Note for <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> devices supporting Android apps:'''
+    },
     'doc_example_value': {
       'desc': '''Caption text of the field 'example value' in the summary chart of a policy in the generated documentation''',
       'text': '''Example value:'''
     },
     'doc_intro': {
       'desc': '''Introduction text for the generated policy documentation''',
       'text': '''Both Chromium and Google Chrome support the same set of
       policies. Please note that this document may include policies that are
       targeted for unreleased software versions (i.e. their 'Supported on' entry
       refers to an unreleased version) and that such policies are subject to
@@ skipping 58 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }