Update FWMP in TPM

chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc

Index: chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
diff --git a/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc b/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
index c4bcf11f3d016e291ce611035e442083827f8090..8c10e6daa7d28e5f9a7baaefefd8733a37453ddb 100644
--- a/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
+++ b/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
@@ -29,6 +29,7 @@
 #include "chromeos/attestation/attestation_flow.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/dbus/auth_policy_client.h"
+#include "chromeos/dbus/cryptohome/rpc.pb.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/upstart_client.h"
 #include "components/version_info/version_info.h"
@@ -393,10 +394,60 @@ void EnrollmentHandlerChromeOS::OnGetTokensResponse(
 
   robot_refresh_token_ = refresh_token;
 
+  SetStep(STEP_SET_FWMP_DATA);
+  SetFirmwareManagementParametersData();
+}
+
+void EnrollmentHandlerChromeOS::SetFirmwareManagementParametersData() {
+  DCHECK_EQ(STEP_SET_FWMP_DATA, enrollment_step_);
+
+  install_attributes_->SetBlockDevmodeInTpm(
+      GetBlockDevmode(),
+      base::Bind(
+          &EnrollmentHandlerChromeOS::OnFirmwareManagementParametersDataSet,
+          weak_ptr_factory_.GetWeakPtr()));
+}
+
+void EnrollmentHandlerChromeOS::OnFirmwareManagementParametersDataSet(
+    chromeos::DBusMethodCallStatus call_status,
+    bool result,
+    const cryptohome::BaseReply& reply) {
+  DCHECK_EQ(STEP_SET_FWMP_DATA, enrollment_step_);
+  if (!result) {
+    LOG(ERROR)
+        << "Failed to update firmware management parameters in TPM, error: "
+        << reply.error();
+  }
+
   SetStep(STEP_AD_DOMAIN_JOIN);
   StartJoinAdDomain();
 }
 
+bool EnrollmentHandlerChromeOS::GetBlockDevmode() {
+  auto policy_data = base::MakeUnique<em::PolicyData>();

[Thiemo Nagel, 2017/03/23 17:23:52]

Please add a CHECK or a DCHECK that policy_ is not unset.

[igorcov, 2017/03/24 13:29:15]

Done.

+  if (!policy_data->ParseFromString(policy_->policy_data())) {
+    LOG(ERROR) << "Failed to parse policy data";
+    return false;
+  }
+
+  std::unique_ptr<em::ChromeDeviceSettingsProto> payload(

[Thiemo Nagel, 2017/03/23 17:23:52]

What's the purpose of the unique_ptr here?  I think it can be dropped.

[igorcov, 2017/03/24 13:29:15]

Done.

+      new em::ChromeDeviceSettingsProto());
+  if (!payload->ParseFromString(policy_data->policy_value())) {
+    LOG(ERROR) << "Failed to parse policy value";
+    return false;
+  }
+
+  bool block_devmode = false;
+  if (payload->has_system_settings()) {
+    const em::SystemSettingsProto& container = payload->system_settings();
+    if (container.has_block_devmode()) {
+      block_devmode = container.block_devmode();
+    }
+  }
+
+  return block_devmode;
+}
+
 // GaiaOAuthClient::Delegate
 void EnrollmentHandlerChromeOS::OnRefreshTokenResponse(
     const std::string& access_token,