Adding a DownloadRestrictions group policy.

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 125 matching lines @@
 #   templates and documentation. The policy definition list that Chrome sees
 #   will include policies marked with 'future'. If a WIP policy isn't meant to
 #   be seen by the policy providers either, the 'supported_on' key should be set
 #   to an empty list.
 #
 # IDs:
 #   Since a Protocol Buffer definition is generated from this file, unique and
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 370
+#   For your editing convenience: highest ID currently used: 371
 #   And don't forget to also update the EnterprisePolicies enum of
 #   histograms.xml (run 'python tools/metrics/histograms/update_policies.py').
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
 #     $1 -> Google Chrome / Chromium
 #     $2 -> Google Chrome OS / Chromium OS
 #     $3 -> Google Chrome Frame / Chromium Frame
 #     $6 is reserved for doc_writer
 #
@@ skipping 1548 matching lines @@
       'desc': '''Configures the cache size that <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use for storing cached media files on the disk.
 
       If you set this policy, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use the provided cache size regardless whether the user has specified the '--media-cache-size' flag or not. The value specified in this policy is not a hard boundary but rather a suggestion to the caching system, any value below a few megabytes is too small and will be rounded up to a sane minimum.
 
       If the value of this policy is 0, the default cache size will be used but the user will not be able to change it.
 
       If this policy is not set the default size will be used and the user will be able to override it with the --media-cache-size flag.''',
       'label': '''Set media disk cache size''',
     },
     {
+      'name': 'DownloadRestrictions',
+      'type': 'int-enum',
+      'schema': {
+        'type': 'integer',
+        'enum': [ 0, 1, 2, 3 ],
+      },
+      'items': [
+        {
+          'name': 'DefaultDownloadSecurity',
+          'value': 0,
+          'caption': '''No special restrictions''',
+        },
+        {
+          'name': 'BlockDangerousDownloads',
+          'value': 1,
+          'caption': '''Block dangerous downloads''',
+        },
+        {
+          'name': 'BlockPotentiallyDangerousDownloads',
+          'value': 2,
+          'caption': '''Block potentially dangerous downloads''',
+        },
+        {
+          'name': 'BlockAllDownloads',
+          'value': 3,
+          'caption': '''Block all downloads''',
+        },
+      ],
+      'supported_on': ['chrome.*:60-', 'chrome_os:60-'],

[pastarmovj, 2017/06/14 08:48:35]

Shouldn't this be 61 by now?

[MAD, 2017/06/14 17:50:21]

Done.

+      'features': {
+        'can_be_recommended': True,
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 2,
+      'id': 371,
+      'caption': '''Allow download restrictions''',
+      'tags': ['local-data-access'],
+      'desc': '''Configures the type of downloads that <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will completely block, without letting users override the security decision.
+
+      If you set this policy, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will prevent certain types of downloads, and won't let user bypass the security warnings.
+
+      When the 'Block dangerous downloads' option is chosen, all downloads are allowed, except for those that carry SafeBrowsing warnings.
+
+      When the 'Block potentially dangerous downloads' option is chosen, all downloads allowed, except for those that carry SafeBrowsing warnings of potentially dangerous downloads.
+
+      When the 'Block all downloads' option is chosen, all downloads are blocked.

[pastarmovj, 2017/06/14 08:48:35]

Add another paragraph that explains what does it mean for the policy to not be
set. I know it is obvious but MS best practices dictate the default behavior to
be explicitly documented. See any other policy for reference.

[MAD, 2017/06/14 17:50:21]

Done.

+
+      Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option.
+
+      But these restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options.''',

[pastarmovj, 2017/06/14 08:48:35]

Do we have a help center article about SafeBrowsing? It feels to me it will be
good to include a link here for people to know what does the restrictions above
really mean.

[pastarmovj, 2017/06/14 08:48:35]

nit: skip the "But ".

[MAD, 2017/06/14 17:50:21]

Done.

[MAD, 2017/06/14 17:50:21]

There are other mentions of safe browsing within other policies (some policies
being directly related to it). Should I add the link there too?

[pastarmovj, 2017/06/16 07:17:13]

If you want to you can do that in another CL. But at least this policy now has
great comprehensive description! :)

+      'label': '''Download restrictions''',
+    },
+    {
       'name': 'DownloadDirectory',
       'type': 'string',
       'schema': { 'type': 'string' },
       'supported_on': ['chrome.*:11-', 'chrome_os:35-'],
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
         'per_profile': True,
       },
       'example_value': '/home/${user_name}/Downloads',
@@ skipping 7969 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }