Don't pass domain and verification key to validation when not required

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/memory/ptr_util.h"
-#include "chrome/browser/browser_process.h"
-#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 #include "chromeos/dbus/session_manager_client.h"
 #include "components/ownership/owner_key_util.h"
 #include "components/policy/core/common/cloud/device_management_service.h"
 #include "components/policy/core/common/external_data_fetcher.h"
 #include "components/policy/core/common/policy_map.h"
 #include "components/policy/core/common/policy_types.h"
 #include "components/policy/proto/cloud_policy.pb.h"
 #include "components/policy/proto/device_management_backend.pb.h"
 
 namespace em = enterprise_management;
@@ skipping 113 matching lines @@
     bool valid_timestamp_required,
     std::unique_ptr<em::PolicyFetchResponse> policy_response,
     const UserCloudPolicyValidator::CompletionCallback& callback,
     chromeos::DeviceSettingsService::OwnershipStatus ownership_status) {
   DCHECK_NE(chromeos::DeviceSettingsService::OWNERSHIP_UNKNOWN,
             ownership_status);
   const em::PolicyData* device_policy_data =
       device_settings_service_->policy_data();
   scoped_refptr<ownership::PublicKey> key =
       device_settings_service_->GetPublicKey();
   if (!key.get() || !key->is_loaded() || !device_policy_data) {

[Andrew T Wilson (Slow), 2016/11/14 09:29:37]

Just to be clear, when is ValidateCachedKey() invoked on this key, to make sure
it's valid? Does DeviceSettingsService() validate the key when it's loaded?

[emaxx, 2016/11/14 16:27:07]

I don't think that the keys from DeviceSettingsService are validated
additionally anywhere.
Not sure whether this is a security risk, as, if I'm not mistaken, the key is
loaded from the file owned by the root.

     status_ = CloudPolicyStore::STATUS_BAD_STATE;
     NotifyStoreLoaded();
     return;
   }
 
   std::unique_ptr<UserCloudPolicyValidator> validator(
       UserCloudPolicyValidator::Create(std::move(policy_response),
                                        background_task_runner()));
   validator->ValidateUsername(account_id_, false);
   validator->ValidatePolicyType(dm_protocol::kChromePublicAccountPolicyType);
@@ skipping 10 matching lines @@
 
   // Validate the DMToken to match what device policy has.
   validator->ValidateDMToken(device_policy_data->request_token(),
                              CloudPolicyValidatorBase::DM_TOKEN_REQUIRED);
 
   // Validate the device id to match what device policy has.
   validator->ValidateDeviceId(device_policy_data->device_id(),
                               CloudPolicyValidatorBase::DEVICE_ID_REQUIRED);
 
   validator->ValidatePayload();
-  policy::BrowserPolicyConnectorChromeOS* connector =
-      g_browser_process->platform_part()->browser_policy_connector_chromeos();
-  validator->ValidateSignature(key->as_string(),
-                               GetPolicyVerificationKey(),
-                               connector->GetEnterpriseDomain(),
-                               false);
+  validator->ValidateSignature(key->as_string());
   validator.release()->StartValidation(callback);
 }
 
 }  // namespace policy