OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_SETTINGS_INSTALL_ATTRIBUTES_H_ |
6 #define CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | 6 #define CHROME_BROWSER_CHROMEOS_SETTINGS_INSTALL_ATTRIBUTES_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 | 10 |
11 #include "base/callback.h" | 11 #include "base/callback.h" |
12 #include "base/compiler_specific.h" | 12 #include "base/compiler_specific.h" |
13 #include "base/files/file_path.h" | 13 #include "base/files/file_path.h" |
14 #include "base/gtest_prod_util.h" | 14 #include "base/gtest_prod_util.h" |
15 #include "base/macros.h" | 15 #include "base/macros.h" |
16 #include "base/memory/weak_ptr.h" | 16 #include "base/memory/weak_ptr.h" |
17 #include "chromeos/dbus/cryptohome_client.h" | 17 #include "chromeos/dbus/cryptohome_client.h" |
18 #include "chromeos/dbus/dbus_method_call_status.h" | 18 #include "chromeos/dbus/dbus_method_call_status.h" |
19 #include "components/policy/core/common/cloud/cloud_policy_constants.h" | 19 #include "components/policy/core/common/cloud/cloud_policy_constants.h" |
20 | 20 |
21 namespace policy { | 21 namespace chromeos { |
22 | 22 |
23 // Brokers access to the enterprise-related installation-time attributes on | 23 // Brokers access to the installation-time attributes on Chrome OS. |
24 // ChromeOS. | 24 class InstallAttributes { |
25 // TODO(zelidrag, mnissler): Rename + move this class - http://crbug.com/249513. | |
26 class EnterpriseInstallAttributes { | |
27 public: | 25 public: |
28 // EnterpriseInstallAttributes status codes. Do not change the numeric ids or | 26 // InstallAttributes status codes. Do not change the numeric ids or the |
29 // the meaning of the existing codes to preserve the interpretability of old | 27 // meaning of the existing codes to preserve the interpretability of old |
30 // logfiles. | 28 // logfiles. |
31 enum LockResult { | 29 enum LockResult { |
32 LOCK_SUCCESS = 0, // Success. | 30 LOCK_SUCCESS = 0, // Success. |
33 LOCK_NOT_READY = 1, // Backend/TPM still initializing. | 31 LOCK_NOT_READY = 1, // Backend/TPM still initializing. |
34 LOCK_TIMEOUT = 2, // Backend/TPM timed out. | 32 LOCK_TIMEOUT = 2, // Backend/TPM timed out. |
35 LOCK_BACKEND_INVALID = 3, // Backend failed to initialize. | 33 LOCK_BACKEND_INVALID = 3, // Backend failed to initialize. |
36 LOCK_ALREADY_LOCKED = 4, // TPM has already been locked. | 34 LOCK_ALREADY_LOCKED = 4, // TPM has already been locked. |
37 LOCK_SET_ERROR = 5, // Failed to set attributes. | 35 LOCK_SET_ERROR = 5, // Failed to set attributes. |
38 LOCK_FINALIZE_ERROR = 6, // Backend failed to lock. | 36 LOCK_FINALIZE_ERROR = 6, // Backend failed to lock. |
39 LOCK_READBACK_ERROR = 7, // Inconsistency reading back registration data. | 37 LOCK_READBACK_ERROR = 7, // Inconsistency reading back registration data. |
40 LOCK_WRONG_DOMAIN = 8, // Device already registered to another domain. | 38 LOCK_WRONG_DOMAIN = 8, // Device already registered to another domain. |
41 LOCK_WRONG_MODE = 9, // Device already locked to a different mode. | 39 LOCK_WRONG_MODE = 9, // Device already locked to a different mode. |
42 }; | 40 }; |
43 | 41 |
44 // A callback to handle responses of methods returning a LockResult value. | 42 // A callback to handle responses of methods returning a LockResult value. |
45 typedef base::Callback<void(LockResult lock_result)> LockResultCallback; | 43 typedef base::Callback<void(LockResult lock_result)> LockResultCallback; |
46 | 44 |
47 // Return serialized InstallAttributes of an enterprise-owned configuration. | 45 // Return serialized InstallAttributes of an enterprise-owned configuration. |
48 static std::string GetEnterpriseOwnedInstallAttributesBlobForTesting( | 46 static std::string GetEnterpriseOwnedInstallAttributesBlobForTesting( |
49 const std::string& user_name); | 47 const std::string& user_name); |
50 | 48 |
51 explicit EnterpriseInstallAttributes( | 49 explicit InstallAttributes(CryptohomeClient* cryptohome_client); |
52 chromeos::CryptohomeClient* cryptohome_client); | 50 ~InstallAttributes(); |
53 ~EnterpriseInstallAttributes(); | |
54 | 51 |
55 // Tries to read install attributes from the cache file which is created early | 52 // Tries to read install attributes from the cache file which is created early |
56 // during the boot process. The cache file is used to work around slow | 53 // during the boot process. The cache file is used to work around slow |
57 // cryptohome startup, which takes a while to register its DBus interface. | 54 // cryptohome startup, which takes a while to register its DBus interface. |
58 // (See http://crosbug.com/37367 for background on this.) | 55 // (See http://crosbug.com/37367 for background on this.) |
59 void Init(const base::FilePath& cache_file); | 56 void Init(const base::FilePath& cache_file); |
60 | 57 |
61 // Makes sure the local caches for enterprise-related install attributes are | 58 // Makes sure the local caches for enterprise-related install attributes are |
62 // up to date with what cryptohome has. This method checks the readiness of | 59 // up to date with what cryptohome has. This method checks the readiness of |
63 // attributes and read them if ready. Actual read will be performed in | 60 // attributes and read them if ready. Actual read will be performed in |
64 // ReadAttributesIfReady(). | 61 // ReadAttributesIfReady(). |
65 void ReadImmutableAttributes(const base::Closure& callback); | 62 void ReadImmutableAttributes(const base::Closure& callback); |
66 | 63 |
67 // Locks the device to be an enterprise device registered by the given user. | 64 // Locks the device to be an enterprise device registered by the given user. |
68 // This can also be called after the lock has already been taken, in which | 65 // This can also be called after the lock has already been taken, in which |
69 // case it checks that the passed user agrees with the locked attribute. | 66 // case it checks that the passed user agrees with the locked attribute. |
70 // |callback| must not be null and is called with the result. Must not be | 67 // |callback| must not be null and is called with the result. Must not be |
71 // called while a previous LockDevice() invocation is still pending. | 68 // called while a previous LockDevice() invocation is still pending. |
72 void LockDevice(const std::string& user, | 69 void LockDevice(const std::string& user, |
73 DeviceMode device_mode, | 70 policy::DeviceMode device_mode, |
74 const std::string& device_id, | 71 const std::string& device_id, |
75 const LockResultCallback& callback); | 72 const LockResultCallback& callback); |
76 | 73 |
77 // Checks whether this is an enterprise device. | 74 // Checks whether this is an enterprise device. |
78 bool IsEnterpriseDevice() const; | 75 bool IsEnterpriseDevice() const; |
79 | 76 |
80 // Checks whether this is a consumer kiosk enabled device. | 77 // Checks whether this is a consumer kiosk enabled device. |
81 bool IsConsumerKioskDeviceWithAutoLaunch(); | 78 bool IsConsumerKioskDeviceWithAutoLaunch(); |
82 | 79 |
83 // Gets the domain this device belongs to or an empty string if the device is | 80 // Gets the domain this device belongs to or an empty string if the device is |
84 // not an enterprise device. | 81 // not an enterprise device. |
85 std::string GetDomain() const; | 82 std::string GetDomain() const; |
86 | 83 |
87 // Gets the device id that was generated when the device was registered. | 84 // Gets the device id that was generated when the device was registered. |
88 // Returns an empty string if the device is not an enterprise device or the | 85 // Returns an empty string if the device is not an enterprise device or the |
89 // device id was not stored in the lockbox (prior to R19). | 86 // device id was not stored in the lockbox (prior to R19). |
90 std::string GetDeviceId(); | 87 std::string GetDeviceId(); |
91 | 88 |
92 // Gets the mode the device was enrolled to. The return value for devices that | 89 // Gets the mode the device was enrolled to. The return value for devices that |
93 // are not locked yet will be DEVICE_MODE_UNKNOWN. | 90 // are not locked yet will be DEVICE_MODE_UNKNOWN. |
94 DeviceMode GetMode(); | 91 policy::DeviceMode GetMode(); |
95 | 92 |
96 protected: | 93 protected: |
97 // True if install attributes have been read successfully. False if read | 94 // True if install attributes have been read successfully. False if read |
98 // failed or no read attempt was made. | 95 // failed or no read attempt was made. |
99 bool device_locked_; | 96 bool device_locked_; |
100 | 97 |
101 // Whether the TPM / install attributes consistency check is running. | 98 // Whether the TPM / install attributes consistency check is running. |
102 bool consistency_check_running_; | 99 bool consistency_check_running_; |
103 | 100 |
104 // To be run after the consistency check has finished. | 101 // To be run after the consistency check has finished. |
105 base::Closure post_check_action_; | 102 base::Closure post_check_action_; |
106 | 103 |
107 // Wether the LockDevice() initiated TPM calls are running. | 104 // Wether the LockDevice() initiated TPM calls are running. |
108 bool device_lock_running_; | 105 bool device_lock_running_; |
109 | 106 |
110 std::string registration_user_; | 107 std::string registration_user_; |
111 std::string registration_domain_; | 108 std::string registration_domain_; |
112 std::string registration_device_id_; | 109 std::string registration_device_id_; |
113 DeviceMode registration_mode_; | 110 policy::DeviceMode registration_mode_; |
114 | 111 |
115 private: | 112 private: |
116 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | 113 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, DeviceLockedFromOlderVersion); |
117 DeviceLockedFromOlderVersion); | 114 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, GetRegistrationUser); |
118 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | 115 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, Init); |
119 GetRegistrationUser); | 116 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, InitForConsumerKiosk); |
120 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, Init); | 117 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, LockCanonicalize); |
121 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | 118 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, |
122 InitForConsumerKiosk); | |
123 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, LockCanonicalize); | |
124 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | |
125 VerifyFakeInstallAttributesCache); | 119 VerifyFakeInstallAttributesCache); |
126 | 120 |
127 // Constants for the possible device modes that can be stored in the lockbox. | 121 // Constants for the possible device modes that can be stored in the lockbox. |
128 static const char kConsumerDeviceMode[]; | 122 static const char kConsumerDeviceMode[]; |
129 static const char kEnterpriseDeviceMode[]; | 123 static const char kEnterpriseDeviceMode[]; |
130 static const char kLegacyRetailDeviceMode[]; | 124 static const char kLegacyRetailDeviceMode[]; |
131 static const char kConsumerKioskDeviceMode[]; | 125 static const char kConsumerKioskDeviceMode[]; |
132 static const char kUnknownDeviceMode[]; | 126 static const char kUnknownDeviceMode[]; |
133 | 127 |
134 // Field names in the lockbox. | 128 // Field names in the lockbox. |
135 static const char kAttrEnterpriseDeviceId[]; | 129 static const char kAttrEnterpriseDeviceId[]; |
136 static const char kAttrEnterpriseDomain[]; | 130 static const char kAttrEnterpriseDomain[]; |
137 static const char kAttrEnterpriseMode[]; | 131 static const char kAttrEnterpriseMode[]; |
138 static const char kAttrEnterpriseOwned[]; | 132 static const char kAttrEnterpriseOwned[]; |
139 static const char kAttrEnterpriseUser[]; | 133 static const char kAttrEnterpriseUser[]; |
140 static const char kAttrConsumerKioskEnabled[]; | 134 static const char kAttrConsumerKioskEnabled[]; |
141 | 135 |
142 // Called by |cryptohome_client_| when the cryptohome service becomes | 136 // Called by |cryptohome_client_| when the cryptohome service becomes |
143 // initially available over D-Bus. | 137 // initially available over D-Bus. |
144 void OnCryptohomeServiceInitiallyAvailable(bool service_is_ready); | 138 void OnCryptohomeServiceInitiallyAvailable(bool service_is_ready); |
145 | 139 |
146 // Translates DeviceMode constants to strings used in the lockbox. | 140 // Translates DeviceMode constants to strings used in the lockbox. |
147 std::string GetDeviceModeString(DeviceMode mode); | 141 std::string GetDeviceModeString(policy::DeviceMode mode); |
148 | 142 |
149 // Translates strings used in the lockbox to DeviceMode values. | 143 // Translates strings used in the lockbox to DeviceMode values. |
150 DeviceMode GetDeviceModeFromString(const std::string& mode); | 144 policy::DeviceMode GetDeviceModeFromString(const std::string& mode); |
151 | 145 |
152 // Decodes the install attributes provided in |attr_map|. | 146 // Decodes the install attributes provided in |attr_map|. |
153 void DecodeInstallAttributes( | 147 void DecodeInstallAttributes( |
154 const std::map<std::string, std::string>& attr_map); | 148 const std::map<std::string, std::string>& attr_map); |
155 | 149 |
156 // Helper for ReadImmutableAttributes. | 150 // Helper for ReadImmutableAttributes. |
157 void ReadAttributesIfReady( | 151 void ReadAttributesIfReady(const base::Closure& callback, |
158 const base::Closure& callback, | 152 DBusMethodCallStatus call_status, |
159 chromeos::DBusMethodCallStatus call_status, | 153 bool result); |
160 bool result); | |
161 | 154 |
162 // Helper for LockDevice(). Handles the result of InstallAttributesIsReady() | 155 // Helper for LockDevice(). Handles the result of InstallAttributesIsReady() |
163 // and continue processing LockDevice if the result is true. | 156 // and continue processing LockDevice if the result is true. |
164 void LockDeviceIfAttributesIsReady( | 157 void LockDeviceIfAttributesIsReady(const std::string& user, |
165 const std::string& user, | 158 policy::DeviceMode device_mode, |
166 DeviceMode device_mode, | 159 const std::string& device_id, |
167 const std::string& device_id, | 160 const LockResultCallback& callback, |
168 const LockResultCallback& callback, | 161 DBusMethodCallStatus call_status, |
169 chromeos::DBusMethodCallStatus call_status, | 162 bool result); |
170 bool result); | |
171 | 163 |
172 // Confirms the registered user and invoke the callback. | 164 // Confirms the registered user and invoke the callback. |
173 void OnReadImmutableAttributes(const std::string& user, | 165 void OnReadImmutableAttributes(const std::string& user, |
174 const LockResultCallback& callback); | 166 const LockResultCallback& callback); |
175 | 167 |
176 // Check state of install attributes against TPM lock state and generate UMA | 168 // Check state of install attributes against TPM lock state and generate UMA |
177 // for the result. Asynchronously retry |dbus_retries| times in case of DBUS | 169 // for the result. Asynchronously retry |dbus_retries| times in case of DBUS |
178 // errors (cryptohomed startup is slow). | 170 // errors (cryptohomed startup is slow). |
179 void TriggerConsistencyCheck(int dbus_retries); | 171 void TriggerConsistencyCheck(int dbus_retries); |
180 | 172 |
181 // Callback for TpmIsOwned() DBUS call. Generates UMA or schedules retry in | 173 // Callback for TpmIsOwned() DBUS call. Generates UMA or schedules retry in |
182 // case of DBUS error. | 174 // case of DBUS error. |
183 void OnTpmOwnerCheckCompleted(int dbus_retries_remaining, | 175 void OnTpmOwnerCheckCompleted(int dbus_retries_remaining, |
184 chromeos::DBusMethodCallStatus call_status, | 176 DBusMethodCallStatus call_status, |
185 bool result); | 177 bool result); |
186 | 178 |
187 // Gets the user that registered the device. Returns an empty string if the | 179 // Gets the user that registered the device. Returns an empty string if the |
188 // device is not an enterprise device. | 180 // device is not an enterprise device. |
189 std::string GetRegistrationUser() const; | 181 std::string GetRegistrationUser() const; |
190 | 182 |
191 chromeos::CryptohomeClient* cryptohome_client_; | 183 CryptohomeClient* cryptohome_client_; |
192 | 184 |
193 base::WeakPtrFactory<EnterpriseInstallAttributes> weak_ptr_factory_; | 185 base::WeakPtrFactory<InstallAttributes> weak_ptr_factory_; |
194 | 186 |
195 DISALLOW_COPY_AND_ASSIGN(EnterpriseInstallAttributes); | 187 DISALLOW_COPY_AND_ASSIGN(InstallAttributes); |
196 }; | 188 }; |
197 | 189 |
198 } // namespace policy | 190 } // namespace chromeos |
199 | 191 |
200 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | 192 #endif // CHROME_BROWSER_CHROMEOS_SETTINGS_INSTALL_ATTRIBUTES_H_ |
OLD | NEW |