| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h" | 5 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h" |
| 6 | 6 |
| 7 #include <utility> | 7 #include <utility> |
| 8 | 8 |
| 9 #include "base/bind.h" | 9 #include "base/bind.h" |
| 10 #include "base/file_util.h" | 10 #include "base/file_util.h" |
| 11 #include "base/location.h" | 11 #include "base/location.h" |
| 12 #include "base/logging.h" | 12 #include "base/logging.h" |
| 13 #include "base/message_loop/message_loop.h" | 13 #include "base/message_loop/message_loop.h" |
| 14 #include "chrome/browser/policy/proto/chromeos/install_attributes.pb.h" | 14 #include "chrome/browser/policy/proto/chromeos/install_attributes.pb.h" |
| 15 #include "chromeos/cryptohome/cryptohome_library.h" | 15 #include "chromeos/cryptohome/cryptohome_library.h" |
| 16 #include "chromeos/dbus/dbus_thread_manager.h" | 16 #include "chromeos/dbus/dbus_thread_manager.h" |
| 17 #include "google_apis/gaia/gaia_auth_util.h" | 17 #include "google_apis/gaia/gaia_auth_util.h" |
| 18 | 18 |
| 19 namespace policy { | 19 namespace policy { |
| 20 | 20 |
| 21 namespace cryptohome_util = chromeos::cryptohome_util; |
| 22 |
| 21 namespace { | 23 namespace { |
| 22 | 24 |
| 23 // Translates DeviceMode constants to strings used in the lockbox. | 25 // Translates DeviceMode constants to strings used in the lockbox. |
| 24 std::string GetDeviceModeString(DeviceMode mode) { | 26 std::string GetDeviceModeString(DeviceMode mode) { |
| 25 switch (mode) { | 27 switch (mode) { |
| 26 case DEVICE_MODE_CONSUMER: | 28 case DEVICE_MODE_CONSUMER: |
| 27 return EnterpriseInstallAttributes::kConsumerDeviceMode; | 29 return EnterpriseInstallAttributes::kConsumerDeviceMode; |
| 28 case DEVICE_MODE_ENTERPRISE: | 30 case DEVICE_MODE_ENTERPRISE: |
| 29 return EnterpriseInstallAttributes::kEnterpiseDeviceMode; | 31 return EnterpriseInstallAttributes::kEnterpiseDeviceMode; |
| 30 case DEVICE_MODE_RETAIL_KIOSK: | 32 case DEVICE_MODE_RETAIL_KIOSK: |
| (...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 81 const char EnterpriseInstallAttributes::kAttrEnterpriseMode[] = | 83 const char EnterpriseInstallAttributes::kAttrEnterpriseMode[] = |
| 82 "enterprise.mode"; | 84 "enterprise.mode"; |
| 83 const char EnterpriseInstallAttributes::kAttrEnterpriseOwned[] = | 85 const char EnterpriseInstallAttributes::kAttrEnterpriseOwned[] = |
| 84 "enterprise.owned"; | 86 "enterprise.owned"; |
| 85 const char EnterpriseInstallAttributes::kAttrEnterpriseUser[] = | 87 const char EnterpriseInstallAttributes::kAttrEnterpriseUser[] = |
| 86 "enterprise.user"; | 88 "enterprise.user"; |
| 87 const char EnterpriseInstallAttributes::kAttrConsumerKioskEnabled[] = | 89 const char EnterpriseInstallAttributes::kAttrConsumerKioskEnabled[] = |
| 88 "consumer.app_kiosk_enabled"; | 90 "consumer.app_kiosk_enabled"; |
| 89 | 91 |
| 90 EnterpriseInstallAttributes::EnterpriseInstallAttributes( | 92 EnterpriseInstallAttributes::EnterpriseInstallAttributes( |
| 91 chromeos::CryptohomeLibrary* cryptohome, | |
| 92 chromeos::CryptohomeClient* cryptohome_client) | 93 chromeos::CryptohomeClient* cryptohome_client) |
| 93 : device_locked_(false), | 94 : device_locked_(false), |
| 94 registration_mode_(DEVICE_MODE_PENDING), | 95 registration_mode_(DEVICE_MODE_PENDING), |
| 95 cryptohome_(cryptohome), | |
| 96 cryptohome_client_(cryptohome_client), | 96 cryptohome_client_(cryptohome_client), |
| 97 weak_ptr_factory_(this) {} | 97 weak_ptr_factory_(this) {} |
| 98 | 98 |
| 99 EnterpriseInstallAttributes::~EnterpriseInstallAttributes() {} | 99 EnterpriseInstallAttributes::~EnterpriseInstallAttributes() {} |
| 100 | 100 |
| 101 void EnterpriseInstallAttributes::ReadCacheFile( | 101 void EnterpriseInstallAttributes::ReadCacheFile( |
| 102 const base::FilePath& cache_file) { | 102 const base::FilePath& cache_file) { |
| 103 if (device_locked_ || !base::PathExists(cache_file)) | 103 if (device_locked_ || !base::PathExists(cache_file)) |
| 104 return; | 104 return; |
| 105 | 105 |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 145 weak_ptr_factory_.GetWeakPtr(), | 145 weak_ptr_factory_.GetWeakPtr(), |
| 146 callback)); | 146 callback)); |
| 147 } | 147 } |
| 148 | 148 |
| 149 void EnterpriseInstallAttributes::ReadAttributesIfReady( | 149 void EnterpriseInstallAttributes::ReadAttributesIfReady( |
| 150 const base::Closure& callback, | 150 const base::Closure& callback, |
| 151 chromeos::DBusMethodCallStatus call_status, | 151 chromeos::DBusMethodCallStatus call_status, |
| 152 bool result) { | 152 bool result) { |
| 153 if (call_status == chromeos::DBUS_METHOD_CALL_SUCCESS && result) { | 153 if (call_status == chromeos::DBUS_METHOD_CALL_SUCCESS && result) { |
| 154 registration_mode_ = DEVICE_MODE_NOT_SET; | 154 registration_mode_ = DEVICE_MODE_NOT_SET; |
| 155 if (!cryptohome_->InstallAttributesIsInvalid() && | 155 if (!cryptohome_util::InstallAttributesIsInvalid() && |
| 156 !cryptohome_->InstallAttributesIsFirstInstall()) { | 156 !cryptohome_util::InstallAttributesIsFirstInstall()) { |
| 157 device_locked_ = true; | 157 device_locked_ = true; |
| 158 | 158 |
| 159 static const char* kEnterpriseAttributes[] = { | 159 static const char* kEnterpriseAttributes[] = { |
| 160 kAttrEnterpriseDeviceId, | 160 kAttrEnterpriseDeviceId, |
| 161 kAttrEnterpriseDomain, | 161 kAttrEnterpriseDomain, |
| 162 kAttrEnterpriseMode, | 162 kAttrEnterpriseMode, |
| 163 kAttrEnterpriseOwned, | 163 kAttrEnterpriseOwned, |
| 164 kAttrEnterpriseUser, | 164 kAttrEnterpriseUser, |
| 165 kAttrConsumerKioskEnabled, | 165 kAttrConsumerKioskEnabled, |
| 166 }; | 166 }; |
| 167 std::map<std::string, std::string> attr_map; | 167 std::map<std::string, std::string> attr_map; |
| 168 for (size_t i = 0; i < arraysize(kEnterpriseAttributes); ++i) { | 168 for (size_t i = 0; i < arraysize(kEnterpriseAttributes); ++i) { |
| 169 std::string value; | 169 std::string value; |
| 170 if (cryptohome_->InstallAttributesGet(kEnterpriseAttributes[i], &value)) | 170 if (cryptohome_util::InstallAttributesGet(kEnterpriseAttributes[i], |
| 171 &value)) |
| 171 attr_map[kEnterpriseAttributes[i]] = value; | 172 attr_map[kEnterpriseAttributes[i]] = value; |
| 172 } | 173 } |
| 173 | 174 |
| 174 DecodeInstallAttributes(attr_map); | 175 DecodeInstallAttributes(attr_map); |
| 175 } | 176 } |
| 176 } | 177 } |
| 177 callback.Run(); | 178 callback.Run(); |
| 178 } | 179 } |
| 179 | 180 |
| 180 void EnterpriseInstallAttributes::LockDevice( | 181 void EnterpriseInstallAttributes::LockDevice( |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 215 const std::string& device_id, | 216 const std::string& device_id, |
| 216 const LockResultCallback& callback, | 217 const LockResultCallback& callback, |
| 217 chromeos::DBusMethodCallStatus call_status, | 218 chromeos::DBusMethodCallStatus call_status, |
| 218 bool result) { | 219 bool result) { |
| 219 if (call_status != chromeos::DBUS_METHOD_CALL_SUCCESS || !result) { | 220 if (call_status != chromeos::DBUS_METHOD_CALL_SUCCESS || !result) { |
| 220 callback.Run(LOCK_NOT_READY); | 221 callback.Run(LOCK_NOT_READY); |
| 221 return; | 222 return; |
| 222 } | 223 } |
| 223 | 224 |
| 224 // Clearing the TPM password seems to be always a good deal. | 225 // Clearing the TPM password seems to be always a good deal. |
| 225 if (cryptohome_->TpmIsEnabled() && | 226 if (cryptohome_util::TpmIsEnabled() && |
| 226 !cryptohome_->TpmIsBeingOwned() && | 227 !cryptohome_util::TpmIsBeingOwned() && |
| 227 cryptohome_->TpmIsOwned()) { | 228 cryptohome_util::TpmIsOwned()) { |
| 228 cryptohome_client_->CallTpmClearStoredPasswordAndBlock(); | 229 cryptohome_client_->CallTpmClearStoredPasswordAndBlock(); |
| 229 } | 230 } |
| 230 | 231 |
| 231 // Make sure we really have a working InstallAttrs. | 232 // Make sure we really have a working InstallAttrs. |
| 232 if (cryptohome_->InstallAttributesIsInvalid()) { | 233 if (cryptohome_util::InstallAttributesIsInvalid()) { |
| 233 LOG(ERROR) << "Install attributes invalid."; | 234 LOG(ERROR) << "Install attributes invalid."; |
| 234 callback.Run(LOCK_BACKEND_ERROR); | 235 callback.Run(LOCK_BACKEND_ERROR); |
| 235 return; | 236 return; |
| 236 } | 237 } |
| 237 | 238 |
| 238 if (!cryptohome_->InstallAttributesIsFirstInstall()) { | 239 if (!cryptohome_util::InstallAttributesIsFirstInstall()) { |
| 239 callback.Run(LOCK_WRONG_USER); | 240 callback.Run(LOCK_WRONG_USER); |
| 240 return; | 241 return; |
| 241 } | 242 } |
| 242 | 243 |
| 243 std::string mode = GetDeviceModeString(device_mode); | 244 std::string mode = GetDeviceModeString(device_mode); |
| 244 std::string registration_user; | 245 std::string registration_user; |
| 245 if (!user.empty()) | 246 if (!user.empty()) |
| 246 registration_user = gaia::CanonicalizeEmail(user); | 247 registration_user = gaia::CanonicalizeEmail(user); |
| 247 | 248 |
| 248 if (device_mode == DEVICE_MODE_CONSUMER_KIOSK) { | 249 if (device_mode == DEVICE_MODE_CONSUMER_KIOSK) { |
| 249 // Set values in the InstallAttrs and lock it. | 250 // Set values in the InstallAttrs and lock it. |
| 250 if (!cryptohome_->InstallAttributesSet(kAttrConsumerKioskEnabled, "true")) { | 251 if (!cryptohome_util::InstallAttributesSet(kAttrConsumerKioskEnabled, |
| 252 "true")) { |
| 251 LOG(ERROR) << "Failed writing attributes"; | 253 LOG(ERROR) << "Failed writing attributes"; |
| 252 callback.Run(LOCK_BACKEND_ERROR); | 254 callback.Run(LOCK_BACKEND_ERROR); |
| 253 return; | 255 return; |
| 254 } | 256 } |
| 255 } else { | 257 } else { |
| 256 std::string domain = gaia::ExtractDomainName(registration_user); | 258 std::string domain = gaia::ExtractDomainName(registration_user); |
| 257 // Set values in the InstallAttrs and lock it. | 259 // Set values in the InstallAttrs and lock it. |
| 258 if (!cryptohome_->InstallAttributesSet(kAttrEnterpriseOwned, "true") || | 260 if (!cryptohome_util::InstallAttributesSet(kAttrEnterpriseOwned, "true") || |
| 259 !cryptohome_->InstallAttributesSet(kAttrEnterpriseUser, | 261 !cryptohome_util::InstallAttributesSet(kAttrEnterpriseUser, |
| 260 registration_user) || | 262 registration_user) || |
| 261 !cryptohome_->InstallAttributesSet(kAttrEnterpriseDomain, domain) || | 263 !cryptohome_util::InstallAttributesSet(kAttrEnterpriseDomain, |
| 262 !cryptohome_->InstallAttributesSet(kAttrEnterpriseMode, mode) || | 264 domain) || |
| 263 !cryptohome_->InstallAttributesSet(kAttrEnterpriseDeviceId, | 265 !cryptohome_util::InstallAttributesSet(kAttrEnterpriseMode, mode) || |
| 264 device_id)) { | 266 !cryptohome_util::InstallAttributesSet(kAttrEnterpriseDeviceId, |
| 267 device_id)) { |
| 265 LOG(ERROR) << "Failed writing attributes"; | 268 LOG(ERROR) << "Failed writing attributes"; |
| 266 callback.Run(LOCK_BACKEND_ERROR); | 269 callback.Run(LOCK_BACKEND_ERROR); |
| 267 return; | 270 return; |
| 268 } | 271 } |
| 269 } | 272 } |
| 270 | 273 |
| 271 if (!cryptohome_->InstallAttributesFinalize() || | 274 if (!cryptohome_util::InstallAttributesFinalize() || |
| 272 cryptohome_->InstallAttributesIsFirstInstall()) { | 275 cryptohome_util::InstallAttributesIsFirstInstall()) { |
| 273 LOG(ERROR) << "Failed locking."; | 276 LOG(ERROR) << "Failed locking."; |
| 274 callback.Run(LOCK_BACKEND_ERROR); | 277 callback.Run(LOCK_BACKEND_ERROR); |
| 275 return; | 278 return; |
| 276 } | 279 } |
| 277 | 280 |
| 278 ReadImmutableAttributes( | 281 ReadImmutableAttributes( |
| 279 base::Bind(&EnterpriseInstallAttributes::OnReadImmutableAttributes, | 282 base::Bind(&EnterpriseInstallAttributes::OnReadImmutableAttributes, |
| 280 weak_ptr_factory_.GetWeakPtr(), | 283 weak_ptr_factory_.GetWeakPtr(), |
| 281 registration_user, | 284 registration_user, |
| 282 callback)); | 285 callback)); |
| (...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 362 &consumer_kiosk_enabled) && | 365 &consumer_kiosk_enabled) && |
| 363 consumer_kiosk_enabled == "true") { | 366 consumer_kiosk_enabled == "true") { |
| 364 registration_mode_ = DEVICE_MODE_CONSUMER_KIOSK; | 367 registration_mode_ = DEVICE_MODE_CONSUMER_KIOSK; |
| 365 } else if (enterprise_user.empty() && enterprise_owned != "true") { | 368 } else if (enterprise_user.empty() && enterprise_owned != "true") { |
| 366 // |registration_user_| is empty on consumer devices. | 369 // |registration_user_| is empty on consumer devices. |
| 367 registration_mode_ = DEVICE_MODE_CONSUMER; | 370 registration_mode_ = DEVICE_MODE_CONSUMER; |
| 368 } | 371 } |
| 369 } | 372 } |
| 370 | 373 |
| 371 } // namespace policy | 374 } // namespace policy |
| OLD | NEW |