Allow explicitly whitelisted apps/extensions in public sessions

chrome/browser/extensions/extension_system.cc

Index: chrome/browser/extensions/extension_system.cc
diff --git a/chrome/browser/extensions/extension_system.cc b/chrome/browser/extensions/extension_system.cc
index 9a6474c5e942213f877dde7873f2f81e3f508634..099bc6050f5e940992db14c1536a7dfa81eae796 100644
--- a/chrome/browser/extensions/extension_system.cc
+++ b/chrome/browser/extensions/extension_system.cc
@@ -48,6 +48,10 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/app_mode/app_mode_utils.h"
+#include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+#include "chrome/browser/chromeos/login/user.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/device_local_account.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/login/login_state.h"
 #endif
@@ -107,7 +111,16 @@ void ExtensionSystemImpl::Shared::InitPrefs() {
 
   standard_management_policy_provider_.reset(
       new StandardManagementPolicyProvider(ExtensionPrefs::Get(profile_)));
-#endif
+
+#if defined (OS_CHROMEOS)
+  const chromeos::User* user = chromeos::UserManager::Get()->GetActiveUser();
+  if (user && policy::IsDeviceLocalAccountUser(user->email())) {
+    device_local_account_management_policy_provider_.reset(
+        new chromeos::DeviceLocalAccountManagementPolicyProvider);
+  }
+#endif  // defined (OS_CHROMEOS)
+
+#endif  // defined(ENABLE_EXTENSIONS)
 }
 
 void ExtensionSystemImpl::Shared::RegisterManagementPolicyProviders() {
@@ -116,7 +129,15 @@ void ExtensionSystemImpl::Shared::RegisterManagementPolicyProviders() {
   DCHECK(standard_management_policy_provider_.get());
   management_policy_->RegisterProvider(
       standard_management_policy_provider_.get());
-#endif
+
+#if defined (OS_CHROMEOS)
+  if (device_local_account_management_policy_provider_) {
+    management_policy_->RegisterProvider(
+        device_local_account_management_policy_provider_.get());
+  }
+#endif  // defined (OS_CHROMEOS)
+
+#endif  // defined(ENABLE_EXTENSIONS)

[asargent_no_longer_on_chrome, 2013/09/24 20:29:00]

It seems a little unfortunate to have this #ifdef'ing going on here, as opposed
to making the concept of a device local management policy more of a first-class
citizen. I guess you aren't doing much work other than initializing a member
variable, so it's probably fine for now, but if we end up needing to put any
more logic inside the #ifdef blocks here it might be time to consider
refactoring. 

[bartfab (slow), 2013/09/26 12:39:13]

Just to clarify, because the name is somewhat misleading: This is not
device-local management policy for regular accounts. This is management policy
for *device-local accounts*. A device-local account is a special breed of Chrome
OS account that is distinct from e.g. regular users.

So what I am working on is not a new source of management policy that may apply
more widely in the future. It is a special source of management policy that goes
hand-in-hand with a special type of account.

 }
 
 void ExtensionSystemImpl::Shared::Init(bool extensions_enabled) {