| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_SETTINGS_INSTALL_ATTRIBUTES_H_ |
| 6 #define CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | 6 #define CHROME_BROWSER_CHROMEOS_SETTINGS_INSTALL_ATTRIBUTES_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <string> | 9 #include <string> |
| 10 | 10 |
| 11 #include "base/callback.h" | 11 #include "base/callback.h" |
| 12 #include "base/compiler_specific.h" | 12 #include "base/compiler_specific.h" |
| 13 #include "base/files/file_path.h" | 13 #include "base/files/file_path.h" |
| 14 #include "base/gtest_prod_util.h" | 14 #include "base/gtest_prod_util.h" |
| 15 #include "base/macros.h" | 15 #include "base/macros.h" |
| 16 #include "base/memory/weak_ptr.h" | 16 #include "base/memory/weak_ptr.h" |
| 17 #include "chromeos/dbus/cryptohome_client.h" | 17 #include "chromeos/dbus/cryptohome_client.h" |
| 18 #include "chromeos/dbus/dbus_method_call_status.h" | 18 #include "chromeos/dbus/dbus_method_call_status.h" |
| 19 #include "components/policy/core/common/cloud/cloud_policy_constants.h" | 19 #include "components/policy/core/common/cloud/cloud_policy_constants.h" |
| 20 | 20 |
| 21 namespace policy { | 21 namespace chromeos { |
| 22 | 22 |
| 23 // Brokers access to the enterprise-related installation-time attributes on | 23 // Brokers access to the installation-time attributes on Chrome OS. |
| 24 // ChromeOS. | 24 class InstallAttributes { |
| 25 // TODO(zelidrag, mnissler): Rename + move this class - http://crbug.com/249513. | |
| 26 class EnterpriseInstallAttributes { | |
| 27 public: | 25 public: |
| 28 // EnterpriseInstallAttributes status codes. Do not change the numeric ids or | 26 // InstallAttributes status codes. Do not change the numeric ids or the |
| 29 // the meaning of the existing codes to preserve the interpretability of old | 27 // meaning of the existing codes to preserve the interpretability of old |
| 30 // logfiles. | 28 // logfiles. |
| 31 enum LockResult { | 29 enum LockResult { |
| 32 LOCK_SUCCESS = 0, // Success. | 30 LOCK_SUCCESS = 0, // Success. |
| 33 LOCK_NOT_READY = 1, // Backend/TPM still initializing. | 31 LOCK_NOT_READY = 1, // Backend/TPM still initializing. |
| 34 LOCK_TIMEOUT = 2, // Backend/TPM timed out. | 32 LOCK_TIMEOUT = 2, // Backend/TPM timed out. |
| 35 LOCK_BACKEND_INVALID = 3, // Backend failed to initialize. | 33 LOCK_BACKEND_INVALID = 3, // Backend failed to initialize. |
| 36 LOCK_ALREADY_LOCKED = 4, // TPM has already been locked. | 34 LOCK_ALREADY_LOCKED = 4, // TPM has already been locked. |
| 37 LOCK_SET_ERROR = 5, // Failed to set attributes. | 35 LOCK_SET_ERROR = 5, // Failed to set attributes. |
| 38 LOCK_FINALIZE_ERROR = 6, // Backend failed to lock. | 36 LOCK_FINALIZE_ERROR = 6, // Backend failed to lock. |
| 39 LOCK_READBACK_ERROR = 7, // Inconsistency reading back registration data. | 37 LOCK_READBACK_ERROR = 7, // Inconsistency reading back registration data. |
| 40 LOCK_WRONG_DOMAIN = 8, // Device already registered to another domain. | 38 LOCK_WRONG_DOMAIN = 8, // Device already registered to another domain. |
| 41 LOCK_WRONG_MODE = 9, // Device already locked to a different mode. | 39 LOCK_WRONG_MODE = 9, // Device already locked to a different mode. |
| 42 }; | 40 }; |
| 43 | 41 |
| 44 // A callback to handle responses of methods returning a LockResult value. | 42 // A callback to handle responses of methods returning a LockResult value. |
| 45 typedef base::Callback<void(LockResult lock_result)> LockResultCallback; | 43 typedef base::Callback<void(LockResult lock_result)> LockResultCallback; |
| 46 | 44 |
| 47 // Return serialized InstallAttributes of an enterprise-owned configuration. | 45 // Return serialized InstallAttributes of an enterprise-owned configuration. |
| 48 static std::string GetEnterpriseOwnedInstallAttributesBlobForTesting( | 46 static std::string GetEnterpriseOwnedInstallAttributesBlobForTesting( |
| 49 const std::string& user_name); | 47 const std::string& user_name); |
| 50 | 48 |
| 51 explicit EnterpriseInstallAttributes( | 49 explicit InstallAttributes(CryptohomeClient* cryptohome_client); |
| 52 chromeos::CryptohomeClient* cryptohome_client); | 50 ~InstallAttributes(); |
| 53 ~EnterpriseInstallAttributes(); | |
| 54 | 51 |
| 55 // Tries to read install attributes from the cache file which is created early | 52 // Tries to read install attributes from the cache file which is created early |
| 56 // during the boot process. The cache file is used to work around slow | 53 // during the boot process. The cache file is used to work around slow |
| 57 // cryptohome startup, which takes a while to register its DBus interface. | 54 // cryptohome startup, which takes a while to register its DBus interface. |
| 58 // (See http://crosbug.com/37367 for background on this.) | 55 // (See http://crosbug.com/37367 for background on this.) |
| 59 void Init(const base::FilePath& cache_file); | 56 void Init(const base::FilePath& cache_file); |
| 60 | 57 |
| 61 // Makes sure the local caches for enterprise-related install attributes are | 58 // Makes sure the local caches for enterprise-related install attributes are |
| 62 // up to date with what cryptohome has. This method checks the readiness of | 59 // up to date with what cryptohome has. This method checks the readiness of |
| 63 // attributes and read them if ready. Actual read will be performed in | 60 // attributes and read them if ready. Actual read will be performed in |
| 64 // ReadAttributesIfReady(). | 61 // ReadAttributesIfReady(). |
| 65 void ReadImmutableAttributes(const base::Closure& callback); | 62 void ReadImmutableAttributes(const base::Closure& callback); |
| 66 | 63 |
| 67 // Locks the device to be an enterprise device registered by the given user. | 64 // Locks the device to be an enterprise device registered by the given user. |
| 68 // This can also be called after the lock has already been taken, in which | 65 // This can also be called after the lock has already been taken, in which |
| 69 // case it checks that the passed user agrees with the locked attribute. | 66 // case it checks that the passed user agrees with the locked attribute. |
| 70 // |callback| must not be null and is called with the result. Must not be | 67 // |callback| must not be null and is called with the result. Must not be |
| 71 // called while a previous LockDevice() invocation is still pending. | 68 // called while a previous LockDevice() invocation is still pending. |
| 72 void LockDevice(const std::string& user, | 69 void LockDevice(const std::string& user, |
| 73 DeviceMode device_mode, | 70 policy::DeviceMode device_mode, |
| 74 const std::string& device_id, | 71 const std::string& device_id, |
| 75 const LockResultCallback& callback); | 72 const LockResultCallback& callback); |
| 76 | 73 |
| 77 // Checks whether this is an enterprise device. | 74 // Checks whether this is an enterprise device. |
| 78 bool IsEnterpriseDevice() const; | 75 bool IsEnterpriseDevice() const; |
| 79 | 76 |
| 80 // Checks whether this is a consumer kiosk enabled device. | 77 // Checks whether this is a consumer kiosk enabled device. |
| 81 bool IsConsumerKioskDeviceWithAutoLaunch(); | 78 bool IsConsumerKioskDeviceWithAutoLaunch(); |
| 82 | 79 |
| 83 // Gets the domain this device belongs to or an empty string if the device is | 80 // Gets the domain this device belongs to or an empty string if the device is |
| 84 // not an enterprise device. | 81 // not an enterprise device. |
| 85 std::string GetDomain() const; | 82 std::string GetDomain() const; |
| 86 | 83 |
| 87 // Gets the device id that was generated when the device was registered. | 84 // Gets the device id that was generated when the device was registered. |
| 88 // Returns an empty string if the device is not an enterprise device or the | 85 // Returns an empty string if the device is not an enterprise device or the |
| 89 // device id was not stored in the lockbox (prior to R19). | 86 // device id was not stored in the lockbox (prior to R19). |
| 90 std::string GetDeviceId(); | 87 std::string GetDeviceId(); |
| 91 | 88 |
| 92 // Gets the mode the device was enrolled to. The return value for devices that | 89 // Gets the mode the device was enrolled to. The return value for devices that |
| 93 // are not locked yet will be DEVICE_MODE_UNKNOWN. | 90 // are not locked yet will be DEVICE_MODE_UNKNOWN. |
| 94 DeviceMode GetMode(); | 91 policy::DeviceMode GetMode(); |
| 95 | 92 |
| 96 protected: | 93 protected: |
| 97 // True if install attributes have been read successfully. False if read | 94 // True if install attributes have been read successfully. False if read |
| 98 // failed or no read attempt was made. | 95 // failed or no read attempt was made. |
| 99 bool device_locked_; | 96 bool device_locked_; |
| 100 | 97 |
| 101 // Whether the TPM / install attributes consistency check is running. | 98 // Whether the TPM / install attributes consistency check is running. |
| 102 bool consistency_check_running_; | 99 bool consistency_check_running_; |
| 103 | 100 |
| 104 // To be run after the consistency check has finished. | 101 // To be run after the consistency check has finished. |
| 105 base::Closure post_check_action_; | 102 base::Closure post_check_action_; |
| 106 | 103 |
| 107 // Wether the LockDevice() initiated TPM calls are running. | 104 // Wether the LockDevice() initiated TPM calls are running. |
| 108 bool device_lock_running_; | 105 bool device_lock_running_; |
| 109 | 106 |
| 110 std::string registration_user_; | 107 std::string registration_user_; |
| 111 std::string registration_domain_; | 108 std::string registration_domain_; |
| 112 std::string registration_device_id_; | 109 std::string registration_device_id_; |
| 113 DeviceMode registration_mode_; | 110 policy::DeviceMode registration_mode_; |
| 114 | 111 |
| 115 private: | 112 private: |
| 116 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | 113 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, DeviceLockedFromOlderVersion); |
| 117 DeviceLockedFromOlderVersion); | 114 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, GetRegistrationUser); |
| 118 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | 115 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, Init); |
| 119 GetRegistrationUser); | 116 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, InitForConsumerKiosk); |
| 120 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, Init); | 117 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, LockCanonicalize); |
| 121 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | 118 FRIEND_TEST_ALL_PREFIXES(InstallAttributesTest, |
| 122 InitForConsumerKiosk); | |
| 123 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, LockCanonicalize); | |
| 124 FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, | |
| 125 VerifyFakeInstallAttributesCache); | 119 VerifyFakeInstallAttributesCache); |
| 126 | 120 |
| 127 // Constants for the possible device modes that can be stored in the lockbox. | 121 // Constants for the possible device modes that can be stored in the lockbox. |
| 128 static const char kConsumerDeviceMode[]; | 122 static const char kConsumerDeviceMode[]; |
| 129 static const char kEnterpriseDeviceMode[]; | 123 static const char kEnterpriseDeviceMode[]; |
| 130 static const char kLegacyRetailDeviceMode[]; | 124 static const char kLegacyRetailDeviceMode[]; |
| 131 static const char kConsumerKioskDeviceMode[]; | 125 static const char kConsumerKioskDeviceMode[]; |
| 132 static const char kUnknownDeviceMode[]; | 126 static const char kUnknownDeviceMode[]; |
| 133 | 127 |
| 134 // Field names in the lockbox. | 128 // Field names in the lockbox. |
| 135 static const char kAttrEnterpriseDeviceId[]; | 129 static const char kAttrEnterpriseDeviceId[]; |
| 136 static const char kAttrEnterpriseDomain[]; | 130 static const char kAttrEnterpriseDomain[]; |
| 137 static const char kAttrEnterpriseMode[]; | 131 static const char kAttrEnterpriseMode[]; |
| 138 static const char kAttrEnterpriseOwned[]; | 132 static const char kAttrEnterpriseOwned[]; |
| 139 static const char kAttrEnterpriseUser[]; | 133 static const char kAttrEnterpriseUser[]; |
| 140 static const char kAttrConsumerKioskEnabled[]; | 134 static const char kAttrConsumerKioskEnabled[]; |
| 141 | 135 |
| 142 // Called by |cryptohome_client_| when the cryptohome service becomes | 136 // Called by |cryptohome_client_| when the cryptohome service becomes |
| 143 // initially available over D-Bus. | 137 // initially available over D-Bus. |
| 144 void OnCryptohomeServiceInitiallyAvailable(bool service_is_ready); | 138 void OnCryptohomeServiceInitiallyAvailable(bool service_is_ready); |
| 145 | 139 |
| 146 // Translates DeviceMode constants to strings used in the lockbox. | 140 // Translates DeviceMode constants to strings used in the lockbox. |
| 147 std::string GetDeviceModeString(DeviceMode mode); | 141 std::string GetDeviceModeString(policy::DeviceMode mode); |
| 148 | 142 |
| 149 // Translates strings used in the lockbox to DeviceMode values. | 143 // Translates strings used in the lockbox to DeviceMode values. |
| 150 DeviceMode GetDeviceModeFromString(const std::string& mode); | 144 policy::DeviceMode GetDeviceModeFromString(const std::string& mode); |
| 151 | 145 |
| 152 // Decodes the install attributes provided in |attr_map|. | 146 // Decodes the install attributes provided in |attr_map|. |
| 153 void DecodeInstallAttributes( | 147 void DecodeInstallAttributes( |
| 154 const std::map<std::string, std::string>& attr_map); | 148 const std::map<std::string, std::string>& attr_map); |
| 155 | 149 |
| 156 // Helper for ReadImmutableAttributes. | 150 // Helper for ReadImmutableAttributes. |
| 157 void ReadAttributesIfReady( | 151 void ReadAttributesIfReady(const base::Closure& callback, |
| 158 const base::Closure& callback, | 152 DBusMethodCallStatus call_status, |
| 159 chromeos::DBusMethodCallStatus call_status, | 153 bool result); |
| 160 bool result); | |
| 161 | 154 |
| 162 // Helper for LockDevice(). Handles the result of InstallAttributesIsReady() | 155 // Helper for LockDevice(). Handles the result of InstallAttributesIsReady() |
| 163 // and continue processing LockDevice if the result is true. | 156 // and continue processing LockDevice if the result is true. |
| 164 void LockDeviceIfAttributesIsReady( | 157 void LockDeviceIfAttributesIsReady(const std::string& user, |
| 165 const std::string& user, | 158 policy::DeviceMode device_mode, |
| 166 DeviceMode device_mode, | 159 const std::string& device_id, |
| 167 const std::string& device_id, | 160 const LockResultCallback& callback, |
| 168 const LockResultCallback& callback, | 161 DBusMethodCallStatus call_status, |
| 169 chromeos::DBusMethodCallStatus call_status, | 162 bool result); |
| 170 bool result); | |
| 171 | 163 |
| 172 // Confirms the registered user and invoke the callback. | 164 // Confirms the registered user and invoke the callback. |
| 173 void OnReadImmutableAttributes(const std::string& user, | 165 void OnReadImmutableAttributes(const std::string& user, |
| 174 const LockResultCallback& callback); | 166 const LockResultCallback& callback); |
| 175 | 167 |
| 176 // Check state of install attributes against TPM lock state and generate UMA | 168 // Check state of install attributes against TPM lock state and generate UMA |
| 177 // for the result. Asynchronously retry |dbus_retries| times in case of DBUS | 169 // for the result. Asynchronously retry |dbus_retries| times in case of DBUS |
| 178 // errors (cryptohomed startup is slow). | 170 // errors (cryptohomed startup is slow). |
| 179 void TriggerConsistencyCheck(int dbus_retries); | 171 void TriggerConsistencyCheck(int dbus_retries); |
| 180 | 172 |
| 181 // Callback for TpmIsOwned() DBUS call. Generates UMA or schedules retry in | 173 // Callback for TpmIsOwned() DBUS call. Generates UMA or schedules retry in |
| 182 // case of DBUS error. | 174 // case of DBUS error. |
| 183 void OnTpmOwnerCheckCompleted(int dbus_retries_remaining, | 175 void OnTpmOwnerCheckCompleted(int dbus_retries_remaining, |
| 184 chromeos::DBusMethodCallStatus call_status, | 176 DBusMethodCallStatus call_status, |
| 185 bool result); | 177 bool result); |
| 186 | 178 |
| 187 // Gets the user that registered the device. Returns an empty string if the | 179 // Gets the user that registered the device. Returns an empty string if the |
| 188 // device is not an enterprise device. | 180 // device is not an enterprise device. |
| 189 std::string GetRegistrationUser() const; | 181 std::string GetRegistrationUser() const; |
| 190 | 182 |
| 191 chromeos::CryptohomeClient* cryptohome_client_; | 183 CryptohomeClient* cryptohome_client_; |
| 192 | 184 |
| 193 base::WeakPtrFactory<EnterpriseInstallAttributes> weak_ptr_factory_; | 185 base::WeakPtrFactory<InstallAttributes> weak_ptr_factory_; |
| 194 | 186 |
| 195 DISALLOW_COPY_AND_ASSIGN(EnterpriseInstallAttributes); | 187 DISALLOW_COPY_AND_ASSIGN(InstallAttributes); |
| 196 }; | 188 }; |
| 197 | 189 |
| 198 } // namespace policy | 190 } // namespace chromeos |
| 199 | 191 |
| 200 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_ | 192 #endif // CHROME_BROWSER_CHROMEOS_SETTINGS_INSTALL_ATTRIBUTES_H_ |
| OLD | NEW |