Allow explicitly whitelisted apps/extensions in public sessions

chrome/browser/extensions/extension_system.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_system.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
@@ skipping 30 matching lines @@
 #include "chrome/common/chrome_version_info.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/features/feature_channel.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/url_data_source.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/manifest.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/app_mode/app_mode_utils.h"
+#include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+#include "chrome/browser/chromeos/login/user.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/device_local_account.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/login/login_state.h"
 #endif
 
 using content::BrowserThread;
 
 namespace extensions {
 
 //
 // ExtensionSystem
@@ skipping 39 matching lines @@
 
   rules_store_.reset(new StateStore(
       profile_,
       profile_->GetPath().AppendASCII(ExtensionService::kRulesStoreName),
       false));
 
   blacklist_.reset(new Blacklist(ExtensionPrefs::Get(profile_)));
 
   standard_management_policy_provider_.reset(
       new StandardManagementPolicyProvider(ExtensionPrefs::Get(profile_)));
-#endif
+
+#if defined (OS_CHROMEOS)
+  const chromeos::User* user = chromeos::UserManager::Get()->GetActiveUser();
+  if (user && policy::IsDeviceLocalAccountUser(user->email())) {
+    device_local_account_management_policy_provider_.reset(
+        new chromeos::DeviceLocalAccountManagementPolicyProvider);
+  }
+#endif  // defined (OS_CHROMEOS)
+
+#endif  // defined(ENABLE_EXTENSIONS)
 }
 
 void ExtensionSystemImpl::Shared::RegisterManagementPolicyProviders() {
 // TODO(yoz): Remove once crbug.com/159265 is fixed.
 #if defined(ENABLE_EXTENSIONS)
   DCHECK(standard_management_policy_provider_.get());
   management_policy_->RegisterProvider(
       standard_management_policy_provider_.get());
-#endif
+
+#if defined (OS_CHROMEOS)
+  if (device_local_account_management_policy_provider_) {
+    management_policy_->RegisterProvider(
+        device_local_account_management_policy_provider_.get());
+  }
+#endif  // defined (OS_CHROMEOS)
+
+#endif  // defined(ENABLE_EXTENSIONS)

[asargent_no_longer_on_chrome, 2013/09/24 20:29:00]

It seems a little unfortunate to have this #ifdef'ing going on here, as opposed
to making the concept of a device local management policy more of a first-class
citizen. I guess you aren't doing much work other than initializing a member
variable, so it's probably fine for now, but if we end up needing to put any
more logic inside the #ifdef blocks here it might be time to consider
refactoring. 

[bartfab (slow), 2013/09/26 12:39:13]

Just to clarify, because the name is somewhat misleading: This is not
device-local management policy for regular accounts. This is management policy
for *device-local accounts*. A device-local account is a special breed of Chrome
OS account that is distinct from e.g. regular users.

So what I am working on is not a new source of management policy that may apply
more widely in the future. It is a special source of management policy that goes
hand-in-hand with a special type of account.

 }
 
 void ExtensionSystemImpl::Shared::Init(bool extensions_enabled) {
   const CommandLine* command_line = CommandLine::ForCurrentProcess();
 
   navigation_observer_.reset(new NavigationObserver(profile_));
 
   bool allow_noisy_errors = !command_line->HasSwitch(switches::kNoErrorDialogs);
   ExtensionErrorReporter::Init(allow_noisy_errors);
 
@@ skipping 252 matching lines @@
 void ExtensionSystemImpl::UnregisterExtensionWithRequestContexts(
     const std::string& extension_id,
     const extension_misc::UnloadedExtensionReason reason) {
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&ExtensionInfoMap::RemoveExtension, info_map(),
                  extension_id, reason));
 }
 
 }  // namespace extensions