OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 #include <utility> | 8 #include <utility> |
9 | 9 |
10 #include "base/bind.h" | 10 #include "base/bind.h" |
11 #include "base/bind_helpers.h" | 11 #include "base/bind_helpers.h" |
12 #include "base/callback.h" | 12 #include "base/callback.h" |
13 #include "base/files/file_util.h" | 13 #include "base/files/file_util.h" |
14 #include "base/location.h" | 14 #include "base/location.h" |
15 #include "base/logging.h" | 15 #include "base/logging.h" |
16 #include "base/macros.h" | 16 #include "base/macros.h" |
17 #include "base/metrics/histogram_macros.h" | 17 #include "base/metrics/histogram_macros.h" |
18 #include "base/sequenced_task_runner.h" | 18 #include "base/sequenced_task_runner.h" |
19 #include "base/stl_util.h" | 19 #include "base/stl_util.h" |
20 #include "base/strings/stringprintf.h" | 20 #include "base/strings/stringprintf.h" |
21 #include "chrome/browser/chromeos/policy/user_policy_token_loader.h" | 21 #include "chrome/browser/chromeos/policy/user_policy_token_loader.h" |
22 #include "chrome/browser/lifetime/application_lifetime.h" | |
22 #include "chromeos/cryptohome/cryptohome_parameters.h" | 23 #include "chromeos/cryptohome/cryptohome_parameters.h" |
23 #include "chromeos/dbus/cryptohome_client.h" | 24 #include "chromeos/dbus/cryptohome_client.h" |
24 #include "chromeos/dbus/session_manager_client.h" | |
25 #include "components/policy/core/common/cloud/cloud_policy_constants.h" | 25 #include "components/policy/core/common/cloud/cloud_policy_constants.h" |
26 #include "components/policy/proto/cloud_policy.pb.h" | 26 #include "components/policy/proto/cloud_policy.pb.h" |
27 #include "components/policy/proto/device_management_local.pb.h" | 27 #include "components/policy/proto/device_management_local.pb.h" |
28 #include "google_apis/gaia/gaia_auth_util.h" | 28 #include "google_apis/gaia/gaia_auth_util.h" |
29 | 29 |
30 namespace em = enterprise_management; | 30 namespace em = enterprise_management; |
31 | 31 |
32 namespace policy { | 32 namespace policy { |
33 | 33 |
34 namespace { | 34 namespace { |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
102 | 102 |
103 void UserCloudPolicyStoreChromeOS::LoadImmediately() { | 103 void UserCloudPolicyStoreChromeOS::LoadImmediately() { |
104 // This blocking D-Bus call is in the startup path and will block the UI | 104 // This blocking D-Bus call is in the startup path and will block the UI |
105 // thread. This only happens when the Profile is created synchronously, which | 105 // thread. This only happens when the Profile is created synchronously, which |
106 // on Chrome OS happens whenever the browser is restarted into the same | 106 // on Chrome OS happens whenever the browser is restarted into the same |
107 // session. That happens when the browser crashes, or right after signin if | 107 // session. That happens when the browser crashes, or right after signin if |
108 // the user has flags configured in about:flags. | 108 // the user has flags configured in about:flags. |
109 // However, on those paths we must load policy synchronously so that the | 109 // However, on those paths we must load policy synchronously so that the |
110 // Profile initialization never sees unmanaged prefs, which would lead to | 110 // Profile initialization never sees unmanaged prefs, which would lead to |
111 // data loss. http://crbug.com/263061 | 111 // data loss. http://crbug.com/263061 |
112 std::string policy_blob = | 112 std::string policy_blob; |
113 chromeos::SessionManagerClient::RetrievePolicyResponseType response_type = | |
113 session_manager_client_->BlockingRetrievePolicyForUser( | 114 session_manager_client_->BlockingRetrievePolicyForUser( |
114 cryptohome::Identification(account_id_)); | 115 cryptohome::Identification(account_id_), &policy_blob); |
115 if (policy_blob.empty()) { | 116 |
116 // The session manager doesn't have policy, or the call failed. | 117 if (response_type == chromeos::SessionManagerClient:: |
118 RetrievePolicyResponseType::SESSION_DOES_NOT_EXIST) { | |
119 LOG(ERROR) | |
120 << "Session manager claims that session doesn't exist; signing out"; | |
121 chrome::AttemptUserExit(); | |
122 return; | |
123 } | |
124 | |
125 if (response_type == | |
126 chromeos::SessionManagerClient::RetrievePolicyResponseType::SUCCESS && | |
127 policy_blob.empty()) { | |
128 // The session manager doesn't have policy. | |
117 NotifyStoreLoaded(); | 129 NotifyStoreLoaded(); |
118 return; | 130 return; |
119 } | 131 } |
120 | 132 |
133 if (response_type != | |
134 chromeos::SessionManagerClient::RetrievePolicyResponseType::SUCCESS) { | |
Daniel Erat
2017/04/21 14:22:45
in this file and others, feel free to pull Retriev
igorcov
2017/04/24 15:06:47
Done.
| |
135 status_ = STATUS_LOAD_ERROR; | |
136 NotifyStoreError(); | |
137 return; | |
138 } | |
139 | |
121 std::unique_ptr<em::PolicyFetchResponse> policy( | 140 std::unique_ptr<em::PolicyFetchResponse> policy( |
122 new em::PolicyFetchResponse()); | 141 new em::PolicyFetchResponse()); |
123 if (!policy->ParseFromString(policy_blob)) { | 142 if (!policy->ParseFromString(policy_blob)) { |
124 status_ = STATUS_PARSE_ERROR; | 143 status_ = STATUS_PARSE_ERROR; |
125 NotifyStoreError(); | 144 NotifyStoreError(); |
126 return; | 145 return; |
127 } | 146 } |
128 | 147 |
129 std::string sanitized_username = | 148 std::string sanitized_username = |
130 cryptohome_client_->BlockingGetSanitizedUsername( | 149 cryptohome_client_->BlockingGetSanitizedUsername( |
(...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
207 } else { | 226 } else { |
208 // Load the policy right after storing it, to make sure it was accepted by | 227 // Load the policy right after storing it, to make sure it was accepted by |
209 // the session manager. An additional validation is performed after the | 228 // the session manager. An additional validation is performed after the |
210 // load; reload the key for that validation too, in case it was rotated. | 229 // load; reload the key for that validation too, in case it was rotated. |
211 ReloadPolicyKey(base::Bind(&UserCloudPolicyStoreChromeOS::Load, | 230 ReloadPolicyKey(base::Bind(&UserCloudPolicyStoreChromeOS::Load, |
212 weak_factory_.GetWeakPtr())); | 231 weak_factory_.GetWeakPtr())); |
213 } | 232 } |
214 } | 233 } |
215 | 234 |
216 void UserCloudPolicyStoreChromeOS::OnPolicyRetrieved( | 235 void UserCloudPolicyStoreChromeOS::OnPolicyRetrieved( |
217 const std::string& policy_blob) { | 236 const std::string& policy_blob, |
218 if (policy_blob.empty()) { | 237 chromeos::SessionManagerClient::RetrievePolicyResponseType response_type) { |
238 // Disallow the sign in when the Chrome OS user session has not started, which | |
239 // should always happen before the profile construction. An attempt to read | |
240 // the policy outside the session will always fail and return an empty policy | |
241 // blob. | |
242 if (response_type == chromeos::SessionManagerClient:: | |
243 RetrievePolicyResponseType::SESSION_DOES_NOT_EXIST) { | |
244 LOG(ERROR) | |
245 << "Session manager claims that session doesn't exist; signing out"; | |
246 chrome::AttemptUserExit(); | |
247 return; | |
248 } | |
249 | |
250 if (policy_blob.empty() && | |
251 response_type == | |
252 chromeos::SessionManagerClient::RetrievePolicyResponseType::SUCCESS) { | |
219 // session_manager doesn't have policy. Adjust internal state and notify | 253 // session_manager doesn't have policy. Adjust internal state and notify |
220 // the world about the policy update. | 254 // the world about the policy update. |
221 policy_map_.Clear(); | 255 policy_map_.Clear(); |
222 policy_.reset(); | 256 policy_.reset(); |
223 policy_signature_public_key_.clear(); | 257 policy_signature_public_key_.clear(); |
224 NotifyStoreLoaded(); | 258 NotifyStoreLoaded(); |
225 return; | 259 return; |
226 } | 260 } |
227 | 261 |
262 if (response_type != | |
263 chromeos::SessionManagerClient::RetrievePolicyResponseType::SUCCESS) { | |
264 status_ = STATUS_LOAD_ERROR; | |
265 NotifyStoreError(); | |
266 return; | |
267 } | |
268 | |
228 std::unique_ptr<em::PolicyFetchResponse> policy( | 269 std::unique_ptr<em::PolicyFetchResponse> policy( |
229 new em::PolicyFetchResponse()); | 270 new em::PolicyFetchResponse()); |
230 if (!policy->ParseFromString(policy_blob)) { | 271 if (!policy->ParseFromString(policy_blob)) { |
231 status_ = STATUS_PARSE_ERROR; | 272 status_ = STATUS_PARSE_ERROR; |
232 NotifyStoreError(); | 273 NotifyStoreError(); |
233 return; | 274 return; |
234 } | 275 } |
235 | 276 |
236 // Load |cached_policy_key_| to verify the loaded policy. | 277 // Load |cached_policy_key_| to verify the loaded policy. |
237 if (is_active_directory_) { | 278 if (is_active_directory_) { |
(...skipping 137 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
375 validator->ValidateUsername(account_id_.GetUserEmail(), true); | 416 validator->ValidateUsername(account_id_.GetUserEmail(), true); |
376 // The policy loaded from session manager need not be validated using the | 417 // The policy loaded from session manager need not be validated using the |
377 // verification key since it is secure, and since there may be legacy policy | 418 // verification key since it is secure, and since there may be legacy policy |
378 // data that was stored without a verification key. | 419 // data that was stored without a verification key. |
379 validator->ValidateSignature(cached_policy_key_); | 420 validator->ValidateSignature(cached_policy_key_); |
380 } | 421 } |
381 return validator; | 422 return validator; |
382 } | 423 } |
383 | 424 |
384 } // namespace policy | 425 } // namespace policy |
OLD | NEW |