| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | |
| 6 #define CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | |
| 7 | |
| 8 #include <map> | |
| 9 #include <string> | |
| 10 | |
| 11 #include "base/callback.h" | |
| 12 #include "base/compiler_specific.h" | |
| 13 #include "base/files/file_path.h" | |
| 14 #include "base/gtest_prod_util.h" | |
| 15 #include "base/macros.h" | |
| 16 #include "base/memory/weak_ptr.h" | |
| 17 #include "chromeos/dbus/cryptohome_client.h" | |
| 18 #include "chromeos/dbus/dbus_method_call_status.h" | |
| 19 #include "components/policy/core/common/cloud/cloud_policy_constants.h" | |
| 20 | |
| 21 namespace policy { | |
| 22 | |
| 23 // Brokers access to the enterprise-related installation-time attributes on | |
| 24 // ChromeOS. | |
| 25 // TODO(zelidrag, mnissler): Rename + move this class - http://crbug.com/249513. | |
| 26 class EnterpriseInstallAttributes { | |
| 27 public: | |
| 28 // EnterpriseInstallAttributes status codes. Do not change the numeric ids or | |
| 29 // the meaning of the existing codes to preserve the interpretability of old | |
| 30 // logfiles. | |
| 31 enum LockResult { | |
| 32 LOCK_SUCCESS = 0, // Success. | |
| 33 LOCK_NOT_READY = 1, // Backend/TPM still initializing. | |
| 34 LOCK_TIMEOUT = 2, // Backend/TPM timed out. | |
| 35 LOCK_BACKEND_INVALID = 3, // Backend failed to initialize. | |
| 36 LOCK_ALREADY_LOCKED = 4, // TPM has already been locked. | |
| 37 LOCK_SET_ERROR = 5, // Failed to set attributes. | |
| 38 LOCK_FINALIZE_ERROR = 6, // Backend failed to lock. | |
| 39 LOCK_READBACK_ERROR = 7, // Inconsistency reading back registration data. | |
| 40 LOCK_WRONG_DOMAIN = 8, // Device already registered to another domain. | |
| 41 LOCK_WRONG_MODE = 9, // Device already locked to a different mode. | |
| 42 }; | |
| 43 | |
| 44 // A callback to handle responses of methods returning a LockResult value. | |
| 45 typedef base::Callback<void(LockResult lock_result)> LockResultCallback; | |
| 46 | |
| 47 // Return serialized InstallAttributes of an enterprise-owned configuration. | |
| 48 static std::string GetEnterpriseOwnedInstallAttributesBlobForTesting( | |
| 49 const std::string& user_name); | |
| 50 | |
| 51 explicit EnterpriseInstallAttributes( | |
| 52 chromeos::CryptohomeClient* cryptohome_client); | |
| 53 ~EnterpriseInstallAttributes(); | |
| 54 | |
| 55 // Tries to read install attributes from the cache file which is created early | |
| 56 // during the boot process. The cache file is used to work around slow | |
| 57 // cryptohome startup, which takes a while to register its DBus interface. | |
| 58 // (See http://crosbug.com/37367 for background on this.) | |
| 59 void Init(const base::FilePath& cache_file); | |
| 60 | |
| 61 // Makes sure the local caches for enterprise-related install attributes are | |
| 62 // up to date with what cryptohome has. This method checks the readiness of | |
| 63 // attributes and read them if ready. Actual read will be performed in | |
| 64 // ReadAttributesIfReady(). | |
| 65 void ReadImmutableAttributes(const base::Closure& callback); | |
| 66 | |
| 67 // Locks the device to be an enterprise device registered by the given user. | |
| 68 // This can also be called after the lock has already been taken, in which | |
| 69 // case it checks that the passed user agrees with the locked attribute. | |
| 70 // |callback| must not be null and is called with the result. Must not be | |
| 71 // called while a previous LockDevice() invocation is still pending. | |
| 72 void LockDevice(const std::string& user, | |
| 73 DeviceMode device_mode, | |
| 74 const std::string& device_id, | |
| 75 const LockResultCallback& callback); | |
| 76 | |
| 77 // Checks whether this is an enterprise device. | |
| 78 bool IsEnterpriseDevice() const; | |
| 79 | |
| 80 // Checks whether this is a consumer kiosk enabled device. | |
| 81 bool IsConsumerKioskDeviceWithAutoLaunch(); | |
| 82 | |
| 83 // Gets the domain this device belongs to or an empty string if the device is | |
| 84 // not an enterprise device. | |
| 85 std::string GetDomain() const; | |
| 86 | |
| 87 // Gets the device id that was generated when the device was registered. | |
| 88 // Returns an empty string if the device is not an enterprise device or the | |
| 89 // device id was not stored in the lockbox (prior to R19). | |
| 90 std::string GetDeviceId(); | |
| 91 | |
| 92 // Gets the mode the device was enrolled to. The return value for devices that | |
| 93 // are not locked yet will be DEVICE_MODE_UNKNOWN. | |
| 94 DeviceMode GetMode(); | |
| 95 | |
| 96 protected: | |
| 97 // True if install attributes have been read successfully. False if read | |
| 98 // failed or no read attempt was made. | |
| 99 bool device_locked_; | |
| 100 | |
| 101 // Whether the TPM / install attributes consistency check is running. | |
| 102 bool consistency_check_running_; | |
| 103 | |
| 104 // To be run after the consistency check has finished. | |
| 105 base::Closure post_check_action_; | |
| 106 | |
| 107 // Wether the LockDevice() initiated TPM calls are running. | |
| 108 bool device_lock_running_; | |
| 109 | |
| 110 std::string registration_user_; | |
| 111 std::string registration_domain_; | |
| 112 std::string registration_device_id_; | |
| 113 DeviceMode registration_mode_; | |
| 114 | |
| 115 private: | |
| 116 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | |
| 117 DeviceLockedFromOlderVersion); | |
| 118 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | |
| 119 GetRegistrationUser); | |
| 120 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, Init); | |
| 121 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | |
| 122 InitForConsumerKiosk); | |
| 123 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, LockCanonicalize); | |
| 124 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | |
| 125 VerifyFakeInstallAttributesCache); | |
| 126 | |
| 127 // Constants for the possible device modes that can be stored in the lockbox. | |
| 128 static const char kConsumerDeviceMode[]; | |
| 129 static const char kEnterpriseDeviceMode[]; | |
| 130 static const char kLegacyRetailDeviceMode[]; | |
| 131 static const char kConsumerKioskDeviceMode[]; | |
| 132 static const char kUnknownDeviceMode[]; | |
| 133 | |
| 134 // Field names in the lockbox. | |
| 135 static const char kAttrEnterpriseDeviceId[]; | |
| 136 static const char kAttrEnterpriseDomain[]; | |
| 137 static const char kAttrEnterpriseMode[]; | |
| 138 static const char kAttrEnterpriseOwned[]; | |
| 139 static const char kAttrEnterpriseUser[]; | |
| 140 static const char kAttrConsumerKioskEnabled[]; | |
| 141 | |
| 142 // Called by |cryptohome_client_| when the cryptohome service becomes | |
| 143 // initially available over D-Bus. | |
| 144 void OnCryptohomeServiceInitiallyAvailable(bool service_is_ready); | |
| 145 | |
| 146 // Translates DeviceMode constants to strings used in the lockbox. | |
| 147 std::string GetDeviceModeString(DeviceMode mode); | |
| 148 | |
| 149 // Translates strings used in the lockbox to DeviceMode values. | |
| 150 DeviceMode GetDeviceModeFromString(const std::string& mode); | |
| 151 | |
| 152 // Decodes the install attributes provided in |attr_map|. | |
| 153 void DecodeInstallAttributes( | |
| 154 const std::map<std::string, std::string>& attr_map); | |
| 155 | |
| 156 // Helper for ReadImmutableAttributes. | |
| 157 void ReadAttributesIfReady( | |
| 158 const base::Closure& callback, | |
| 159 chromeos::DBusMethodCallStatus call_status, | |
| 160 bool result); | |
| 161 | |
| 162 // Helper for LockDevice(). Handles the result of InstallAttributesIsReady() | |
| 163 // and continue processing LockDevice if the result is true. | |
| 164 void LockDeviceIfAttributesIsReady( | |
| 165 const std::string& user, | |
| 166 DeviceMode device_mode, | |
| 167 const std::string& device_id, | |
| 168 const LockResultCallback& callback, | |
| 169 chromeos::DBusMethodCallStatus call_status, | |
| 170 bool result); | |
| 171 | |
| 172 // Confirms the registered user and invoke the callback. | |
| 173 void OnReadImmutableAttributes(const std::string& user, | |
| 174 const LockResultCallback& callback); | |
| 175 | |
| 176 // Check state of install attributes against TPM lock state and generate UMA | |
| 177 // for the result. Asynchronously retry |dbus_retries| times in case of DBUS | |
| 178 // errors (cryptohomed startup is slow). | |
| 179 void TriggerConsistencyCheck(int dbus_retries); | |
| 180 | |
| 181 // Callback for TpmIsOwned() DBUS call. Generates UMA or schedules retry in | |
| 182 // case of DBUS error. | |
| 183 void OnTpmOwnerCheckCompleted(int dbus_retries_remaining, | |
| 184 chromeos::DBusMethodCallStatus call_status, | |
| 185 bool result); | |
| 186 | |
| 187 // Gets the user that registered the device. Returns an empty string if the | |
| 188 // device is not an enterprise device. | |
| 189 std::string GetRegistrationUser() const; | |
| 190 | |
| 191 chromeos::CryptohomeClient* cryptohome_client_; | |
| 192 | |
| 193 base::WeakPtrFactory<EnterpriseInstallAttributes> weak_ptr_factory_; | |
| 194 | |
| 195 DISALLOW_COPY_AND_ASSIGN(EnterpriseInstallAttributes); | |
| 196 }; | |
| 197 | |
| 198 } // namespace policy | |
| 199 | |
| 200 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2382833002:
Rename policy::EnterpriseInstallAttributes to chromeos::InstallAttributes. (Closed)
