Allow explicitly whitelisted apps/extensions in public sessions

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/values.h"
 #include "chrome/browser/policy/cloud/device_management_service.h"
@@ skipping 68 matching lines @@
   InstallPolicy(validator->policy_data().Pass(), validator->payload().Pass());
   // Exit the session when the lid is closed. The default behavior is to
   // suspend while leaving the session running, which is not desirable for
   // public sessions.
   policy_map_.Set(key::kLidCloseAction,
                   POLICY_LEVEL_MANDATORY,
                   POLICY_SCOPE_USER,
                   base::Value::CreateIntegerValue(
                       chromeos::PowerPolicyController::ACTION_STOP_SESSION),
                   NULL);
-
   // Force the |ShelfAutoHideBehavior| policy to |Never|, ensuring that the ash
   // shelf does not auto-hide.
   policy_map_.Set(key::kShelfAutoHideBehavior,
                   POLICY_LEVEL_MANDATORY,
                   POLICY_SCOPE_USER,
                   Value::CreateStringValue("Never"),
                   NULL);
   // Force the |ShowLogoutButtonInTray| policy to |true|, ensuring that a big,
   // red logout button is shown in the ash system tray.
   policy_map_.Set(key::kShowLogoutButtonInTray,
                   POLICY_LEVEL_MANDATORY,
                   POLICY_SCOPE_USER,
                   Value::CreateBooleanValue(true),
                   NULL);
   // Force the |FullscreenAllowed| policy to |false|, ensuring that the ash
   // shelf cannot be hidden by entering fullscreen mode.
   policy_map_.Set(key::kFullscreenAllowed,
                   POLICY_LEVEL_MANDATORY,
                   POLICY_SCOPE_USER,
                   Value::CreateBooleanValue(false),
                   NULL);
-  // Restrict device-local accounts to hosted apps for now (i.e. no extensions,
-  // packaged apps etc.) for security/privacy reasons (i.e. we'd like to
-  // prevent the admin from stealing private information from random people).
-  scoped_ptr<base::ListValue> allowed_extension_types(new base::ListValue());
-  allowed_extension_types->AppendString("hosted_app");
-  policy_map_.Set(key::kExtensionAllowedTypes,
-                  POLICY_LEVEL_MANDATORY,
-                  POLICY_SCOPE_USER,
-                  allowed_extension_types.release(),
-                  NULL);
 
   status_ = STATUS_OK;
   NotifyStoreLoaded();
 }
 
 void DeviceLocalAccountPolicyStore::StoreValidatedPolicy(
     UserCloudPolicyValidator* validator) {
   if (!validator->success()) {
     status_ = CloudPolicyStore::STATUS_VALIDATION_ERROR;
     validation_status_ = validator->status();
@@ skipping 55 matching lines @@
   validator->ValidateAgainstCurrentPolicy(
       policy(),
       CloudPolicyValidatorBase::TIMESTAMP_REQUIRED,
       CloudPolicyValidatorBase::DM_TOKEN_REQUIRED);
   validator->ValidatePayload();
   validator->ValidateSignature(*key->public_key(), false);
   validator.release()->StartValidation(callback);
 }
 
 }  // namespace policy