Update FWMP in TPM

chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 11 matching lines @@
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/channel_info.h"
 #include "chromeos/attestation/attestation_flow.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/dbus/auth_policy_client.h"
+#include "chromeos/dbus/cryptohome/rpc.pb.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/upstart_client.h"
 #include "components/version_info/version_info.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "net/http/http_status_code.h"
 
 namespace em = enterprise_management;
 
 namespace policy {
@@ skipping 344 matching lines @@
 
 // GaiaOAuthClient::Delegate callback for OAuth2 refresh token fetched.
 void EnrollmentHandlerChromeOS::OnGetTokensResponse(
     const std::string& refresh_token,
     const std::string& access_token,
     int expires_in_seconds) {
   CHECK_EQ(STEP_ROBOT_AUTH_REFRESH, enrollment_step_);
 
   robot_refresh_token_ = refresh_token;
 
+  SetStep(STEP_SET_FWMP_DATA);
+  SetFirmwareManagementParametersData();
+}
+
+void EnrollmentHandlerChromeOS::SetFirmwareManagementParametersData() {
+  DCHECK_EQ(STEP_SET_FWMP_DATA, enrollment_step_);
+
+  install_attributes_->SetBlockDevmodeInTpm(
+      GetBlockDevmode(),
+      base::Bind(
+          &EnrollmentHandlerChromeOS::OnFirmwareManagementParametersDataSet,
+          weak_ptr_factory_.GetWeakPtr()));
+}
+
+void EnrollmentHandlerChromeOS::OnFirmwareManagementParametersDataSet(
+    chromeos::DBusMethodCallStatus call_status,
+    bool result,
+    const cryptohome::BaseReply& reply) {
+  DCHECK_EQ(STEP_SET_FWMP_DATA, enrollment_step_);
+  if (!result) {
+    LOG(ERROR)
+        << "Failed to update firmware management parameters in TPM, error: "
+        << reply.error();
+  }
+
   SetStep(STEP_AD_DOMAIN_JOIN);
   StartJoinAdDomain();
 }
 
+bool EnrollmentHandlerChromeOS::GetBlockDevmode() {
+  auto policy_data = base::MakeUnique<em::PolicyData>();

[Thiemo Nagel, 2017/03/23 17:23:52]

Please add a CHECK or a DCHECK that policy_ is not unset.

[igorcov, 2017/03/24 13:29:15]

Done.

+  if (!policy_data->ParseFromString(policy_->policy_data())) {
+    LOG(ERROR) << "Failed to parse policy data";
+    return false;
+  }
+
+  std::unique_ptr<em::ChromeDeviceSettingsProto> payload(

[Thiemo Nagel, 2017/03/23 17:23:52]

What's the purpose of the unique_ptr here?  I think it can be dropped.

[igorcov, 2017/03/24 13:29:15]

Done.

+      new em::ChromeDeviceSettingsProto());
+  if (!payload->ParseFromString(policy_data->policy_value())) {
+    LOG(ERROR) << "Failed to parse policy value";
+    return false;
+  }
+
+  bool block_devmode = false;
+  if (payload->has_system_settings()) {
+    const em::SystemSettingsProto& container = payload->system_settings();
+    if (container.has_block_devmode()) {
+      block_devmode = container.block_devmode();
+    }
+  }
+
+  return block_devmode;
+}
+
 // GaiaOAuthClient::Delegate
 void EnrollmentHandlerChromeOS::OnRefreshTokenResponse(
     const std::string& access_token,
     int expires_in_seconds) {
   // We never use the code that should trigger this callback.
   LOG(FATAL) << "Unexpected callback invoked.";
 }
 
 // GaiaOAuthClient::Delegate OAuth2 error when fetching refresh token request.
 void EnrollmentHandlerChromeOS::OnOAuthError() {
@@ skipping 189 matching lines @@
     callback.Run(status);
 }
 
 void EnrollmentHandlerChromeOS::SetStep(EnrollmentStep step) {
   DCHECK_LE(enrollment_step_, step);
   VLOG(1) << "Step: " << step;
   enrollment_step_ = step;
 }
 
 }  // namespace policy