Fix handling of device cloud signing policy key rotation

chromeos/dbus/fake_session_manager_client.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/dbus/fake_session_manager_client.h"
 
 #include "base/bind.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/location.h"
+#include "base/numerics/safe_conversions.h"
+#include "base/path_service.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "chromeos/chromeos_paths.h"
 #include "chromeos/dbus/cryptohome_client.h"
+#include "components/policy/proto/device_management_backend.pb.h"
 
 namespace chromeos {
 
+namespace {
+
+// Store the owner key in a file on the disk, so that it can be loaded by
+// DeviceSettingsService and used e.g. for validating policy signatures in the
+// integration tests. This is done on behalf of the real session manager, that
+// would be managing the owner key file on Chrome OS.
+bool StoreOwnerKey(const std::string& public_key) {
+  base::FilePath owner_key_path;
+  DCHECK(base::PathService::Get(FILE_OWNER_KEY, &owner_key_path));
+  if (!base::CreateDirectory(owner_key_path.DirName())) {
+    LOG(ERROR) << "Failed to create the directory for the owner key file";
+    return false;
+  }
+  if (base::WriteFile(owner_key_path, public_key.c_str(),
+                      public_key.length()) !=
+      base::checked_cast<int>(public_key.length())) {
+    LOG(ERROR) << "Failed to store the owner key file";
+    return false;
+  }
+  return true;
+}
+
+}  // namespace
+
 FakeSessionManagerClient::FakeSessionManagerClient()
     : start_device_wipe_call_count_(0),
       request_lock_screen_call_count_(0),
       notify_lock_screen_shown_call_count_(0),
       notify_lock_screen_dismissed_call_count_(0),
       arc_available_(false) {}
 
 FakeSessionManagerClient::~FakeSessionManagerClient() {
 }
 
@@ skipping 88 matching lines @@
     const std::string& account_id,
     const RetrievePolicyCallback& callback) {
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(callback, device_local_account_policy_[account_id]));
 }
 
 void FakeSessionManagerClient::StoreDevicePolicy(
     const std::string& policy_blob,
     const StorePolicyCallback& callback) {
+  enterprise_management::PolicyFetchResponse policy;
+  if (!policy.ParseFromString(policy_blob)) {
+    LOG(ERROR) << "Unable to parse policy protobuf";
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE, base::Bind(callback, false /* success */));
+    return;
+  }
+
+  bool owner_key_store_success = false;
+  if (policy.has_new_public_key())
+    owner_key_store_success = StoreOwnerKey(policy.new_public_key());
   device_policy_ = policy_blob;
-  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                base::Bind(callback, true));
+
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::Bind(callback, true /* success */));
+  if (policy.has_new_public_key()) {
+    for (auto& observer : observers_)
+      observer.OwnerKeySet(owner_key_store_success);
+  }
   for (auto& observer : observers_)
-    observer.PropertyChangeComplete(true);
+    observer.PropertyChangeComplete(true /* success */);
 }
 
 void FakeSessionManagerClient::StorePolicyForUser(
     const cryptohome::Identification& cryptohome_id,
     const std::string& policy_blob,
     const StorePolicyCallback& callback) {
   user_policies_[cryptohome_id] = policy_blob;
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
                                                 base::Bind(callback, true));
 }
@@ skipping 107 matching lines @@
     const std::string& policy_blob) {
   device_local_account_policy_[account_id] = policy_blob;
 }
 
 void FakeSessionManagerClient::OnPropertyChangeComplete(bool success) {
   for (auto& observer : observers_)
     observer.PropertyChangeComplete(success);
 }
 
 }  // namespace chromeos