Add "kiosk_only" manifest attribute for platform apps.

chrome/browser/extensions/crx_installer.cc

Index: chrome/browser/extensions/crx_installer.cc
diff --git a/chrome/browser/extensions/crx_installer.cc b/chrome/browser/extensions/crx_installer.cc
index 2f793a28d3d5ce38f03f02f51fc09b04900ff202..cc9a50503af6a04d1c6a4fa5e9bc63d27227627b 100644
--- a/chrome/browser/extensions/crx_installer.cc
+++ b/chrome/browser/extensions/crx_installer.cc
@@ -38,6 +38,7 @@
 #include "chrome/common/extensions/extension_file_util.h"
 #include "chrome/common/extensions/extension_icon_set.h"
 #include "chrome/common/extensions/feature_switch.h"
+#include "chrome/common/extensions/manifest_handlers/kiosk_mode_info.h"
 #include "chrome/common/extensions/manifest_handlers/shared_module_info.h"
 #include "chrome/common/extensions/manifest_url_handler.h"
 #include "chrome/common/extensions/permissions/permission_set.h"
@@ -55,6 +56,10 @@
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/login/user_manager.h"
+#endif
+
 using content::BrowserThread;
 using content::UserMetricsAction;
 using extensions::SharedModuleInfo;
@@ -512,6 +517,19 @@ void CrxInstaller::ConfirmInstall() {
   if (!service || service->browser_terminating())
     return;
 
+  if (KioskOnlyInfo::IsKioskOnly(installer_.extension())) {

[not at google - send to devlin, 2013/09/24 18:35:17]

installation sure; but what about extension loading? I remember the email about
this but being confused...

[Tim Song, 2013/09/24 18:50:01]

Can an extension be loaded without being first installed?

[not at google - send to devlin, 2013/09/24 18:55:18]

I mean like, if somebody installs in kiosk mode then switches into non-kiosk
mode.

Also there is the unpacked installation case.

Lastly: what happens if an extension is installed in kiosk mode then synced to a
profile that isn't in kiosk mode?

[Tim Song, 2013/09/24 19:09:06]

For kiosk mode, ChromeOS generates a special local account and cryptohome for
each app that is registered to be run in kiosk mode. You can't login to this
account for a regular session nor can you sync the profile.

[not at google - send to devlin, 2013/09/24 19:22:27]

Ok cool.

You might want to still be cautious and add this check in UnpackedInstaller,
since on desktop somebody could grab the CRX, unpack it, then install it that
way. Maybe you don't want that.

One last question here though: what about policy installations?

+    bool in_kiosk_mode = false;
+#if defined(OS_CHROMEOS)
+    chromeos::UserManager* user_manager = chromeos::UserManager::Get();
+    in_kiosk_mode = user_manager && user_manager->IsLoggedInAsKioskApp();
+#endif
+    if (!in_kiosk_mode) {
+      ReportFailureFromUIThread(CrxInstallerError(
+          l10n_util::GetStringUTF16(
+              IDS_EXTENSION_INSTALL_KIOSK_MODE_ONLY)));
+    }
+  }
+
   string16 error = installer_.CheckManagementPolicy();
   if (!error.empty()) {
     // We don't want to show the error infobar for installs from the WebStore,