Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h"
 
 #include <stdint.h>
 
 #include <memory>
+#include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/location.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "chromeos/dbus/mock_cryptohome_client.h"
 #include "chromeos/dbus/mock_session_manager_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/core/common/cloud/mock_cloud_policy_store.h"
 #include "components/policy/core/common/cloud/policy_builder.h"
 #include "components/policy/core/common/policy_types.h"
 #include "components/policy/policy_constants.h"
 #include "components/policy/proto/cloud_policy.pb.h"
 #include "components/policy/proto/device_management_local.pb.h"
+#include "crypto/rsa_private_key.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace em = enterprise_management;
 
 using testing::AllOf;
 using testing::AnyNumber;
 using testing::Eq;
 using testing::Mock;
 using testing::Property;
@@ skipping 95 matching lines @@
   // Stores the current |policy_| and verifies that it is published.
   // If |new_public_key| is set then it will be persisted after storing but
   // before loading the policy, so that the signature validation can succeed.
   // If |previous_value| is set then a previously existing policy with that
   // value will be expected; otherwise no previous policy is expected.
   // If |new_value| is set then a new policy with that value is expected after
   // storing the |policy_| blob.
   void PerformStorePolicy(const std::vector<uint8_t>* new_public_key,
                           const char* previous_value,
                           const char* new_value) {
+    const CloudPolicyStore::Status initial_status = store_->status();
+
     chromeos::SessionManagerClient::StorePolicyCallback store_callback;
     EXPECT_CALL(session_manager_client_,
                 StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
         .WillOnce(SaveArg<2>(&store_callback));
     store_->Store(policy_.policy());
     base::RunLoop().RunUntilIdle();
     Mock::VerifyAndClearExpectations(&session_manager_client_);
     ASSERT_FALSE(store_callback.is_null());
 
     // The new policy shouldn't be present yet.
     PolicyMap previous_policy;
-    EXPECT_EQ(previous_value != NULL, store_->policy() != NULL);
+    EXPECT_EQ(previous_value != nullptr, store_->policy() != nullptr);
     if (previous_value) {
       previous_policy.Set(key::kHomepageLocation, POLICY_LEVEL_MANDATORY,
                           POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
                           base::MakeUnique<base::StringValue>(previous_value),
                           nullptr);
     }
     EXPECT_TRUE(previous_policy.Equals(store_->policy_map()));
-    EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+    EXPECT_EQ(initial_status, store_->status());
 
     // Store the new public key so that the validation after the retrieve
     // operation completes can verify the signature.
     if (new_public_key)
       StoreUserPolicyKey(*new_public_key);
 
     // Let the store operation complete.
     chromeos::SessionManagerClient::RetrievePolicyCallback retrieve_callback;
     EXPECT_CALL(session_manager_client_,
                 RetrievePolicyForUser(cryptohome_id_, _))
         .WillOnce(SaveArg<1>(&retrieve_callback));
     store_callback.Run(true);
     base::RunLoop().RunUntilIdle();
     EXPECT_TRUE(previous_policy.Equals(store_->policy_map()));
-    EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+    EXPECT_EQ(initial_status, store_->status());
     Mock::VerifyAndClearExpectations(&session_manager_client_);
     ASSERT_FALSE(retrieve_callback.is_null());
 
     // Finish the retrieve callback.
     EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
     retrieve_callback.Run(policy_.GetBlob());
     base::RunLoop().RunUntilIdle();
     ASSERT_TRUE(store_->policy());
     EXPECT_EQ(policy_.policy_data().SerializeAsString(),
               store_->policy()->SerializeAsString());
     VerifyPolicyMap(new_value);
     EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
   }
 
   void VerifyStoreHasValidationError() {
     EXPECT_FALSE(store_->policy());
     EXPECT_TRUE(store_->policy_map().empty());
     EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
   }
 
+  static std::string ConvertPublicKeyToString(
+      const std::vector<uint8_t>& public_key) {
+    return std::string(reinterpret_cast<const char*>(public_key.data()),
+                       public_key.size());
+  }
+
+  std::string GetPolicyPublicKeyAsString() {
+    std::vector<uint8_t> public_key;
+    EXPECT_TRUE(policy_.GetSigningKey()->ExportPublicKey(&public_key));
+    return ConvertPublicKeyToString(public_key);
+  }
+
+  std::string GetPolicyNewPublicKeyAsString() {
+    std::vector<uint8_t> new_public_key;
+    EXPECT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
+    return ConvertPublicKeyToString(new_public_key);
+  }
+
   base::FilePath user_policy_dir() {
     return tmp_dir_.GetPath().AppendASCII("var_run_user_policy");
   }
 
   base::FilePath user_policy_key_file() {
     return user_policy_dir().AppendASCII(kSanitizedUsername)
                             .AppendASCII("policy.pub");
   }
 
+  base::FilePath legacy_cache_dir() {
+    return tmp_dir_.GetPath().AppendASCII("legacy_cache");
+  }
+
   base::FilePath token_file() {
-    return tmp_dir_.GetPath().AppendASCII("token");
+    return legacy_cache_dir().AppendASCII("token");
   }
 
   base::FilePath policy_file() {
-    return tmp_dir_.GetPath().AppendASCII("policy");
+    return legacy_cache_dir().AppendASCII("policy");
   }
 
   base::MessageLoopForUI loop_;
   chromeos::MockCryptohomeClient cryptohome_client_;
   chromeos::MockSessionManagerClient session_manager_client_;
   UserPolicyBuilder policy_;
   MockCloudPolicyStoreObserver observer_;
   std::unique_ptr<UserCloudPolicyStoreChromeOS> store_;
   const AccountId account_id_ =
       AccountId::FromUserEmail(PolicyBuilder::kFakeUsername);
   const cryptohome::Identification cryptohome_id_ =
       cryptohome::Identification(account_id_);
 
  private:
   base::ScopedTempDir tmp_dir_;
 
   DISALLOW_COPY_AND_ASSIGN(UserCloudPolicyStoreChromeOSTest);
 };
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, InitialStore) {
   // Start without any public key to trigger the initial key checks.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   std::vector<uint8_t> new_public_key;
   ASSERT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
   ASSERT_NO_FATAL_FAILURE(
-      PerformStorePolicy(&new_public_key, NULL, kDefaultHomepage));
+      PerformStorePolicy(&new_public_key, nullptr, kDefaultHomepage));
+  EXPECT_EQ(ConvertPublicKeyToString(new_public_key), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, InitialStoreValidationFail) {
   // Start without any public key to trigger the initial key checks.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   // Make the policy blob contain a new public key.
   policy_.SetDefaultSigningKey();
   policy_.Build();
   *policy_.policy().mutable_new_public_key_verification_signature_deprecated() =
       "garbage";
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, InitialStoreMissingSignatureFailure) {
   // Start without any public key to trigger the initial key checks.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   // Make the policy blob contain a new public key.
   policy_.SetDefaultSigningKey();
   policy_.Build();
   policy_.policy().clear_new_public_key_verification_signature_deprecated();
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithExistingKey) {
   ASSERT_NO_FATAL_FAILURE(
-      PerformStorePolicy(NULL, NULL, kDefaultHomepage));
+      PerformStorePolicy(nullptr, nullptr, kDefaultHomepage));
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithRotation) {
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   std::vector<uint8_t> new_public_key;
   ASSERT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
   ASSERT_NO_FATAL_FAILURE(
-      PerformStorePolicy(&new_public_key, NULL, kDefaultHomepage));
+      PerformStorePolicy(&new_public_key, nullptr, kDefaultHomepage));
+  EXPECT_EQ(ConvertPublicKeyToString(new_public_key), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest,
        StoreWithRotationMissingSignatureError) {
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   policy_.policy().clear_new_public_key_verification_signature_deprecated();
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithRotationValidationError) {
   // Make the policy blob contain a new public key.
   policy_.SetDefaultNewSigningKey();
   policy_.Build();
   *policy_.policy().mutable_new_public_key_verification_signature_deprecated() =
       "garbage";
 
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreFail) {
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .WillOnce(SaveArg<2>(&store_callback));
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   ASSERT_FALSE(store_callback.is_null());
 
   // Let the store operation complete.
   ExpectError(CloudPolicyStore::STATUS_STORE_ERROR);
   store_callback.Run(false);
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreValidationError) {
   policy_.policy_data().clear_policy_type();
   policy_.Build();
 
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithoutPolicyKey) {
   // Make the dbus call to cryptohome fail.
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
   EXPECT_CALL(cryptohome_client_, GetSanitizedUsername(cryptohome_id_, _))
       .Times(AnyNumber())
       .WillRepeatedly(SendSanitizedUsername(chromeos::DBUS_METHOD_CALL_FAILURE,
                                             std::string()));
 
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, StoreWithInvalidSignature) {
   // Break the signature.
   policy_.policy().mutable_policy_data_signature()->append("garbage");
 
   // Store policy.
   chromeos::SessionManagerClient::StorePolicyCallback store_callback;
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   EXPECT_CALL(session_manager_client_,
               StorePolicyForUser(cryptohome_id_, policy_.GetBlob(), _))
       .Times(0);
   store_->Store(policy_.policy());
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&session_manager_client_);
+  EXPECT_EQ(std::string(), store_->public_key());
+}
+
+TEST_F(UserCloudPolicyStoreChromeOSTest, MultipleStoresWithRotation) {
+  // Store initial policy signed with the initial public key.
+  ASSERT_NO_FATAL_FAILURE(
+      PerformStorePolicy(nullptr, nullptr, kDefaultHomepage));
+  const std::string initial_public_key = GetPolicyPublicKeyAsString();
+  EXPECT_EQ(initial_public_key, store_->public_key());
+
+  // Try storing an invalid policy signed with the new public key.
+  policy_.SetDefaultNewSigningKey();
+  policy_.policy_data().clear_policy_type();
+  policy_.Build();
+  ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
+  store_->Store(policy_.policy());
+  base::RunLoop().RunUntilIdle();
+  // Still the initial public key is exposed.
+  EXPECT_EQ(initial_public_key, store_->public_key());
+
+  // Store the correct policy signed with the new public key.
+  policy_.policy_data().set_policy_type(dm_protocol::kChromeUserPolicyType);
+  policy_.Build();
+  std::vector<uint8_t> new_public_key;
+  ASSERT_TRUE(policy_.GetNewSigningKey()->ExportPublicKey(&new_public_key));
+  ASSERT_NO_FATAL_FAILURE(
+      PerformStorePolicy(&new_public_key, kDefaultHomepage, kDefaultHomepage));
+  EXPECT_EQ(GetPolicyNewPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, Load) {
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Verify that the policy has been loaded.
   ASSERT_TRUE(store_->policy());
   EXPECT_EQ(policy_.policy_data().SerializeAsString(),
             store_->policy()->SerializeAsString());
   VerifyPolicyMap(kDefaultHomepage);
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadNoPolicy) {
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(""));
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Verify no policy has been installed.
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadInvalidPolicy) {
   ExpectError(CloudPolicyStore::STATUS_PARSE_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad("invalid"));
 
   // Verify no policy has been installed.
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_PARSE_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadValidationError) {
   policy_.policy_data().clear_policy_type();
   policy_.Build();
 
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   VerifyStoreHasValidationError();
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadNoKey) {
   // The loaded policy can't be verified without the public key.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   VerifyStoreHasValidationError();
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadInvalidSignature) {
   // Break the signature.
   policy_.policy().mutable_policy_data_signature()->append("garbage");
   ExpectError(CloudPolicyStore::STATUS_VALIDATION_ERROR);
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(policy_.GetBlob()));
   VerifyStoreHasValidationError();
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, MigrationFull) {
   std::string data;
 
+  ASSERT_TRUE(base::CreateDirectory(legacy_cache_dir()));
+
   em::DeviceCredentials credentials;
   credentials.set_device_token(kLegacyToken);
   credentials.set_device_id(kLegacyDeviceId);
   ASSERT_TRUE(credentials.SerializeToString(&data));
   ASSERT_NE(-1, base::WriteFile(token_file(), data.c_str(), data.size()));
 
   em::CachedCloudPolicyResponse cached_policy;
   cached_policy.mutable_cloud_policy()->CopyFrom(policy_.policy());
   ASSERT_TRUE(cached_policy.SerializeToString(&data));
   ASSERT_NE(-1, base::WriteFile(policy_file(), data.c_str(), data.size()));
@@ skipping 13 matching lines @@
   EXPECT_EQ(expected_policy_data.SerializeAsString(),
             store_->policy()->SerializeAsString());
   VerifyPolicyMap(kDefaultHomepage);
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, MigrationNoToken) {
   std::string data;
   testing::Sequence seq;
 
+  ASSERT_TRUE(base::CreateDirectory(legacy_cache_dir()));
+
   em::CachedCloudPolicyResponse cached_policy;
   cached_policy.mutable_cloud_policy()->CopyFrom(policy_.policy());
   ASSERT_TRUE(cached_policy.SerializeToString(&data));
   ASSERT_NE(-1, base::WriteFile(policy_file(), data.c_str(), data.size()));
 
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(""));
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Verify the legacy cache has been loaded.
   em::PolicyData expected_policy_data;
   EXPECT_TRUE(expected_policy_data.ParseFromString(
                   cached_policy.cloud_policy().policy_data()));
   expected_policy_data.clear_public_key_version();
   ASSERT_TRUE(store_->policy());
   EXPECT_EQ(expected_policy_data.SerializeAsString(),
             store_->policy()->SerializeAsString());
   VerifyPolicyMap(kDefaultHomepage);
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, MigrationNoPolicy) {
   std::string data;
 
+  ASSERT_TRUE(base::CreateDirectory(legacy_cache_dir()));
+
   em::DeviceCredentials credentials;
   credentials.set_device_token(kLegacyToken);
   credentials.set_device_id(kLegacyDeviceId);
   ASSERT_TRUE(credentials.SerializeToString(&data));
   ASSERT_NE(-1, base::WriteFile(token_file(), data.c_str(), data.size()));
 
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(""));
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Verify that legacy user policy and token have been loaded.
   em::PolicyData expected_policy_data;
   expected_policy_data.set_request_token(kLegacyToken);
   expected_policy_data.set_device_id(kLegacyDeviceId);
   ASSERT_TRUE(store_->policy());
   EXPECT_EQ(expected_policy_data.SerializeAsString(),
             store_->policy()->SerializeAsString());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, MigrationAndStoreNew) {
   // Start without an existing public key.
   ASSERT_TRUE(base::DeleteFile(user_policy_key_file(), false));
 
+  ASSERT_TRUE(base::CreateDirectory(legacy_cache_dir()));
+
   std::string data;
   em::CachedCloudPolicyResponse cached_policy;
   cached_policy.mutable_cloud_policy()->CopyFrom(policy_.policy());
   ASSERT_TRUE(cached_policy.SerializeToString(&data));
   ASSERT_NE(-1, base::WriteFile(policy_file(), data.c_str(), data.size()));
 
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   ASSERT_NO_FATAL_FAILURE(PerformPolicyLoad(""));
   Mock::VerifyAndClearExpectations(&observer_);
 
@@ skipping 40 matching lines @@
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
 
   // The policy should become available without having to spin any loops.
   ASSERT_TRUE(store_->policy());
   EXPECT_EQ(policy_.policy_data().SerializeAsString(),
             store_->policy()->SerializeAsString());
   VerifyPolicyMap(kDefaultHomepage);
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(GetPolicyPublicKeyAsString(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyNoPolicy) {
   EXPECT_CALL(observer_, OnStoreLoaded(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return(""));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyInvalidBlob) {
   EXPECT_CALL(observer_, OnStoreError(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return("le blob"));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_PARSE_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyDBusFailure) {
   EXPECT_CALL(observer_, OnStoreError(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return(policy_.GetBlob()));
   EXPECT_CALL(cryptohome_client_, BlockingGetSanitizedUsername(cryptohome_id_))
       .WillOnce(Return(""));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 TEST_F(UserCloudPolicyStoreChromeOSTest, LoadImmediatelyNoUserPolicyKey) {
   EXPECT_CALL(observer_, OnStoreError(store_.get()));
   EXPECT_CALL(session_manager_client_,
               BlockingRetrievePolicyForUser(cryptohome_id_))
       .WillOnce(Return(policy_.GetBlob()));
   EXPECT_CALL(cryptohome_client_, BlockingGetSanitizedUsername(cryptohome_id_))
       .WillOnce(Return("wrong@example.com"));
 
   EXPECT_FALSE(store_->policy());
   store_->LoadImmediately();
   Mock::VerifyAndClearExpectations(&observer_);
   Mock::VerifyAndClearExpectations(&session_manager_client_);
   Mock::VerifyAndClearExpectations(&cryptohome_client_);
 
   EXPECT_FALSE(store_->policy());
   EXPECT_TRUE(store_->policy_map().empty());
   EXPECT_EQ(CloudPolicyStore::STATUS_VALIDATION_ERROR, store_->status());
+  EXPECT_EQ(std::string(), store_->public_key());
 }
 
 }  // namespace
 
 }  // namespace policy