| OLD | NEW |
| 1 // Copyright (c) 2014 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/policy/core/common/policy_loader_win.h" | 5 #include "components/policy/core/common/policy_loader_win.h" |
| 6 | 6 |
| 7 #include <windows.h> | |
| 8 #include <ntdsapi.h> // For Ds[Un]Bind | 7 #include <ntdsapi.h> // For Ds[Un]Bind |
| 9 #include <rpc.h> // For struct GUID | 8 #include <rpc.h> // For struct GUID |
| 10 #include <shlwapi.h> // For PathIsUNC() | 9 #include <shlwapi.h> // For PathIsUNC() |
| 11 #include <stddef.h> | 10 #include <stddef.h> |
| 12 #include <userenv.h> // For GPO functions | 11 #include <userenv.h> // For GPO functions |
| 13 | 12 |
| 14 #include <memory> | 13 #include <memory> |
| 15 #include <string> | 14 #include <string> |
| 16 #include <utility> | 15 #include <utility> |
| 17 #include <vector> | 16 #include <vector> |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 63 | 62 |
| 64 // List of policies that are considered only if the user is part of a AD domain. | 63 // List of policies that are considered only if the user is part of a AD domain. |
| 65 // Please document any new additions in policy_templates.json! | 64 // Please document any new additions in policy_templates.json! |
| 66 const char* kInsecurePolicies[] = { | 65 const char* kInsecurePolicies[] = { |
| 67 key::kMetricsReportingEnabled, key::kDefaultSearchProviderEnabled, | 66 key::kMetricsReportingEnabled, key::kDefaultSearchProviderEnabled, |
| 68 key::kHomepageIsNewTabPage, key::kHomepageLocation, | 67 key::kHomepageIsNewTabPage, key::kHomepageLocation, |
| 69 key::kNewTabPageLocation, key::kRestoreOnStartup, | 68 key::kNewTabPageLocation, key::kRestoreOnStartup, |
| 70 key::kRestoreOnStartupURLs}; | 69 key::kRestoreOnStartupURLs}; |
| 71 | 70 |
| 72 #pragma warning(push) | 71 #pragma warning(push) |
| 73 #pragma warning(disable: 4068) // unknown pragmas | 72 #pragma warning(disable : 4068) // unknown pragmas |
| 74 // TODO(dcheng): Remove pragma once http://llvm.org/PR24007 is fixed. | 73 // TODO(dcheng): Remove pragma once http://llvm.org/PR24007 is fixed. |
| 75 #pragma clang diagnostic ignored "-Wmissing-braces" | 74 #pragma clang diagnostic ignored "-Wmissing-braces" |
| 76 // The GUID of the registry settings group policy extension. | 75 // The GUID of the registry settings group policy extension. |
| 77 GUID kRegistrySettingsCSEGUID = REGISTRY_EXTENSION_GUID; | 76 GUID kRegistrySettingsCSEGUID = REGISTRY_EXTENSION_GUID; |
| 78 #pragma warning(pop) | 77 #pragma warning(pop) |
| 79 | 78 |
| 80 // The list of possible errors that can occur while collecting information about | 79 // The list of possible errors that can occur while collecting information about |
| 81 // the current enterprise environment. | 80 // the current enterprise environment. |
| 82 // This enum is used to define the buckets for an enumerated UMA histogram. | 81 // This enum is used to define the buckets for an enumerated UMA histogram. |
| 83 // Hence, | 82 // Hence, |
| (...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 125 invalid_policies++; | 124 invalid_policies++; |
| 126 } | 125 } |
| 127 | 126 |
| 128 filtered_values->AppendString(entry); | 127 filtered_values->AppendString(entry); |
| 129 } | 128 } |
| 130 if (invalid_policies) { | 129 if (invalid_policies) { |
| 131 PolicyMap::Entry filtered_entry = map_entry->DeepCopy(); | 130 PolicyMap::Entry filtered_entry = map_entry->DeepCopy(); |
| 132 filtered_entry.value = std::move(filtered_values); | 131 filtered_entry.value = std::move(filtered_values); |
| 133 policy->Set(key::kExtensionInstallForcelist, std::move(filtered_entry)); | 132 policy->Set(key::kExtensionInstallForcelist, std::move(filtered_entry)); |
| 134 | 133 |
| 135 const PolicyDetails* details = GetChromePolicyDetails( | 134 const PolicyDetails* details = |
| 136 key::kExtensionInstallForcelist); | 135 GetChromePolicyDetails(key::kExtensionInstallForcelist); |
| 137 UMA_HISTOGRAM_SPARSE_SLOWLY("EnterpriseCheck.InvalidPolicies", | 136 UMA_HISTOGRAM_SPARSE_SLOWLY("EnterpriseCheck.InvalidPolicies", |
| 138 details->id); | 137 details->id); |
| 139 } | 138 } |
| 140 } | 139 } |
| 141 | 140 |
| 142 for (size_t i = 0; i < arraysize(kInsecurePolicies); ++i) { | 141 for (size_t i = 0; i < arraysize(kInsecurePolicies); ++i) { |
| 143 if (policy->Get(kInsecurePolicies[i])) { | 142 if (policy->Get(kInsecurePolicies[i])) { |
| 144 // TODO(pastarmovj): Surface this issue in the about:policy page. | 143 // TODO(pastarmovj): Surface this issue in the about:policy page. |
| 145 policy->Erase(kInsecurePolicies[i]); | 144 policy->Erase(kInsecurePolicies[i]); |
| 146 invalid_policies++; | 145 invalid_policies++; |
| 147 const PolicyDetails* details = | 146 const PolicyDetails* details = |
| 148 GetChromePolicyDetails(kInsecurePolicies[i]); | 147 GetChromePolicyDetails(kInsecurePolicies[i]); |
| 149 UMA_HISTOGRAM_SPARSE_SLOWLY("EnterpriseCheck.InvalidPolicies", | 148 UMA_HISTOGRAM_SPARSE_SLOWLY("EnterpriseCheck.InvalidPolicies", |
| 150 details->id); | 149 details->id); |
| 151 } | 150 } |
| 152 } | 151 } |
| 153 | 152 |
| 154 UMA_HISTOGRAM_COUNTS("EnterpriseCheck.InvalidPoliciesDetected", | 153 UMA_HISTOGRAM_COUNTS("EnterpriseCheck.InvalidPoliciesDetected", |
| 155 invalid_policies); | 154 invalid_policies); |
| 156 } | 155 } |
| 157 | 156 |
| 158 // A helper class encapsulating run-time-linked function calls to Wow64 APIs. | 157 // A helper class encapsulating run-time-linked function calls to Wow64 APIs. |
| 159 class Wow64Functions { | 158 class Wow64Functions { |
| 160 public: | 159 public: |
| 161 Wow64Functions() | 160 Wow64Functions() |
| 162 : kernel32_lib_(base::FilePath(L"kernel32")), | 161 : kernel32_lib_(base::FilePath(L"kernel32")), |
| 163 is_wow_64_process_(NULL), | 162 is_wow_64_process_(NULL), |
| 164 wow_64_disable_wow_64_fs_redirection_(NULL), | 163 wow_64_disable_wow_64_fs_redirection_(NULL), |
| 165 wow_64_revert_wow_64_fs_redirection_(NULL) { | 164 wow_64_revert_wow_64_fs_redirection_(NULL) { |
| 166 if (kernel32_lib_.is_valid()) { | 165 if (kernel32_lib_.is_valid()) { |
| 167 is_wow_64_process_ = reinterpret_cast<IsWow64Process>( | 166 is_wow_64_process_ = reinterpret_cast<IsWow64Process>( |
| 168 kernel32_lib_.GetFunctionPointer("IsWow64Process")); | 167 kernel32_lib_.GetFunctionPointer("IsWow64Process")); |
| 169 wow_64_disable_wow_64_fs_redirection_ = | 168 wow_64_disable_wow_64_fs_redirection_ = |
| 170 reinterpret_cast<Wow64DisableWow64FSRedirection>( | 169 reinterpret_cast<Wow64DisableWow64FSRedirection>( |
| 171 kernel32_lib_.GetFunctionPointer( | 170 kernel32_lib_.GetFunctionPointer( |
| 172 "Wow64DisableWow64FsRedirection")); | 171 "Wow64DisableWow64FsRedirection")); |
| 173 wow_64_revert_wow_64_fs_redirection_ = | 172 wow_64_revert_wow_64_fs_redirection_ = |
| 174 reinterpret_cast<Wow64RevertWow64FSRedirection>( | 173 reinterpret_cast<Wow64RevertWow64FSRedirection>( |
| 175 kernel32_lib_.GetFunctionPointer( | 174 kernel32_lib_.GetFunctionPointer( |
| 176 "Wow64RevertWow64FsRedirection")); | 175 "Wow64RevertWow64FsRedirection")); |
| 177 } | 176 } |
| 178 } | 177 } |
| 179 | 178 |
| 180 bool is_valid() { | 179 bool is_valid() { |
| 181 return is_wow_64_process_ && | 180 return is_wow_64_process_ && wow_64_disable_wow_64_fs_redirection_ && |
| 182 wow_64_disable_wow_64_fs_redirection_ && | 181 wow_64_revert_wow_64_fs_redirection_; |
| 183 wow_64_revert_wow_64_fs_redirection_; | |
| 184 } | 182 } |
| 185 | 183 |
| 186 bool IsWow64() { | 184 bool IsWow64() { |
| 187 BOOL result = 0; | 185 BOOL result = 0; |
| 188 if (!is_wow_64_process_(GetCurrentProcess(), &result)) | 186 if (!is_wow_64_process_(GetCurrentProcess(), &result)) |
| 189 PLOG(WARNING) << "IsWow64ProcFailed"; | 187 PLOG(WARNING) << "IsWow64ProcFailed"; |
| 190 return !!result; | 188 return !!result; |
| 191 } | 189 } |
| 192 | 190 |
| 193 bool DisableFsRedirection(PVOID* previous_state) { | 191 bool DisableFsRedirection(PVOID* previous_state) { |
| 194 return !!wow_64_disable_wow_64_fs_redirection_(previous_state); | 192 return !!wow_64_disable_wow_64_fs_redirection_(previous_state); |
| 195 } | 193 } |
| 196 | 194 |
| 197 bool RevertFsRedirection(PVOID previous_state) { | 195 bool RevertFsRedirection(PVOID previous_state) { |
| 198 return !!wow_64_revert_wow_64_fs_redirection_(previous_state); | 196 return !!wow_64_revert_wow_64_fs_redirection_(previous_state); |
| 199 } | 197 } |
| 200 | 198 |
| 201 private: | 199 private: |
| 202 typedef BOOL (WINAPI* IsWow64Process)(HANDLE, PBOOL); | 200 typedef BOOL(WINAPI* IsWow64Process)(HANDLE, PBOOL); |
| 203 typedef BOOL (WINAPI* Wow64DisableWow64FSRedirection)(PVOID*); | 201 typedef BOOL(WINAPI* Wow64DisableWow64FSRedirection)(PVOID*); |
| 204 typedef BOOL (WINAPI* Wow64RevertWow64FSRedirection)(PVOID); | 202 typedef BOOL(WINAPI* Wow64RevertWow64FSRedirection)(PVOID); |
| 205 | 203 |
| 206 base::ScopedNativeLibrary kernel32_lib_; | 204 base::ScopedNativeLibrary kernel32_lib_; |
| 207 | 205 |
| 208 IsWow64Process is_wow_64_process_; | 206 IsWow64Process is_wow_64_process_; |
| 209 Wow64DisableWow64FSRedirection wow_64_disable_wow_64_fs_redirection_; | 207 Wow64DisableWow64FSRedirection wow_64_disable_wow_64_fs_redirection_; |
| 210 Wow64RevertWow64FSRedirection wow_64_revert_wow_64_fs_redirection_; | 208 Wow64RevertWow64FSRedirection wow_64_revert_wow_64_fs_redirection_; |
| 211 | 209 |
| 212 DISALLOW_COPY_AND_ASSIGN(Wow64Functions); | 210 DISALLOW_COPY_AND_ASSIGN(Wow64Functions); |
| 213 }; | 211 }; |
| 214 | 212 |
| 215 // Global Wow64Function instance used by ScopedDisableWow64Redirection below. | 213 // Global Wow64Function instance used by ScopedDisableWow64Redirection below. |
| 216 static base::LazyInstance<Wow64Functions>::DestructorAtExit g_wow_64_functions = | 214 static base::LazyInstance<Wow64Functions>::DestructorAtExit g_wow_64_functions = |
| 217 LAZY_INSTANCE_INITIALIZER; | 215 LAZY_INSTANCE_INITIALIZER; |
| 218 | 216 |
| 219 // Scoper that switches off Wow64 File System Redirection during its lifetime. | 217 // Scoper that switches off Wow64 File System Redirection during its lifetime. |
| 220 class ScopedDisableWow64Redirection { | 218 class ScopedDisableWow64Redirection { |
| 221 public: | 219 public: |
| 222 ScopedDisableWow64Redirection() | 220 ScopedDisableWow64Redirection() : active_(false), previous_state_(NULL) { |
| 223 : active_(false), | |
| 224 previous_state_(NULL) { | |
| 225 Wow64Functions* wow64 = g_wow_64_functions.Pointer(); | 221 Wow64Functions* wow64 = g_wow_64_functions.Pointer(); |
| 226 if (wow64->is_valid() && wow64->IsWow64()) { | 222 if (wow64->is_valid() && wow64->IsWow64()) { |
| 227 if (wow64->DisableFsRedirection(&previous_state_)) | 223 if (wow64->DisableFsRedirection(&previous_state_)) |
| 228 active_ = true; | 224 active_ = true; |
| 229 else | 225 else |
| 230 PLOG(WARNING) << "Wow64DisableWow64FSRedirection"; | 226 PLOG(WARNING) << "Wow64DisableWow64FSRedirection"; |
| 231 } | 227 } |
| 232 } | 228 } |
| 233 | 229 |
| 234 ~ScopedDisableWow64Redirection() { | 230 ~ScopedDisableWow64Redirection() { |
| (...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 365 // Reset the watches BEFORE reading the individual policies to avoid | 361 // Reset the watches BEFORE reading the individual policies to avoid |
| 366 // missing a change notification. | 362 // missing a change notification. |
| 367 if (is_initialized_) | 363 if (is_initialized_) |
| 368 SetupWatches(); | 364 SetupWatches(); |
| 369 | 365 |
| 370 // Policy scope and corresponding hive. | 366 // Policy scope and corresponding hive. |
| 371 static const struct { | 367 static const struct { |
| 372 PolicyScope scope; | 368 PolicyScope scope; |
| 373 HKEY hive; | 369 HKEY hive; |
| 374 } kScopes[] = { | 370 } kScopes[] = { |
| 375 { POLICY_SCOPE_MACHINE, HKEY_LOCAL_MACHINE }, | 371 {POLICY_SCOPE_MACHINE, HKEY_LOCAL_MACHINE}, |
| 376 { POLICY_SCOPE_USER, HKEY_CURRENT_USER }, | 372 {POLICY_SCOPE_USER, HKEY_CURRENT_USER}, |
| 377 }; | 373 }; |
| 378 | 374 |
| 379 bool honor_policies = ShouldHonorPolicies(); | 375 bool honor_policies = ShouldHonorPolicies(); |
| 380 VLOG(1) << "Reading policy from the registry is " | 376 VLOG(1) << "Reading policy from the registry is " |
| 381 << (honor_policies ? "enabled." : "disabled."); | 377 << (honor_policies ? "enabled." : "disabled."); |
| 382 | 378 |
| 383 // Load policy data for the different scopes/levels and merge them. | 379 // Load policy data for the different scopes/levels and merge them. |
| 384 std::unique_ptr<PolicyBundle> bundle(new PolicyBundle()); | 380 std::unique_ptr<PolicyBundle> bundle(new PolicyBundle()); |
| 385 PolicyMap* chrome_policy = | 381 PolicyMap* chrome_policy = |
| 386 &bundle->Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())); | 382 &bundle->Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string())); |
| 387 for (size_t i = 0; i < arraysize(kScopes); ++i) { | 383 for (size_t i = 0; i < arraysize(kScopes); ++i) { |
| 388 PolicyScope scope = kScopes[i].scope; | 384 PolicyScope scope = kScopes[i].scope; |
| 389 PolicyLoadStatusSample status; | 385 PolicyLoadStatusUmaReporter status; |
| 390 RegistryDict gpo_dict; | 386 RegistryDict gpo_dict; |
| 391 | 387 |
| 392 // Note: GPO rules mandate a call to EnterCriticalPolicySection() here, and | 388 // Note: GPO rules mandate a call to EnterCriticalPolicySection() here, and |
| 393 // a matching LeaveCriticalPolicySection() call below after the | 389 // a matching LeaveCriticalPolicySection() call below after the |
| 394 // ReadPolicyFromGPO() block. Unfortunately, the policy mutex may be | 390 // ReadPolicyFromGPO() block. Unfortunately, the policy mutex may be |
| 395 // unavailable for extended periods of time, and there are reports of this | 391 // unavailable for extended periods of time, and there are reports of this |
| 396 // happening in the wild: http://crbug.com/265862. | 392 // happening in the wild: http://crbug.com/265862. |
| 397 // | 393 // |
| 398 // Blocking for minutes is neither acceptable for Chrome startup, nor on | 394 // Blocking for minutes is neither acceptable for Chrome startup, nor on |
| 399 // the FILE thread on which this code runs in steady state. Given that | 395 // the FILE thread on which this code runs in steady state. Given that |
| (...skipping 27 matching lines...) Expand all Loading... |
| 427 // Load 3rd-party policy. | 423 // Load 3rd-party policy. |
| 428 if (third_party_dict) | 424 if (third_party_dict) |
| 429 Load3rdPartyPolicy(third_party_dict.get(), scope, bundle.get()); | 425 Load3rdPartyPolicy(third_party_dict.get(), scope, bundle.get()); |
| 430 } | 426 } |
| 431 | 427 |
| 432 return bundle; | 428 return bundle; |
| 433 } | 429 } |
| 434 | 430 |
| 435 bool PolicyLoaderWin::ReadPRegFile(const base::FilePath& preg_file, | 431 bool PolicyLoaderWin::ReadPRegFile(const base::FilePath& preg_file, |
| 436 RegistryDict* policy, | 432 RegistryDict* policy, |
| 437 PolicyLoadStatusSample* status) { | 433 PolicyLoadStatusSampler* status) { |
| 438 // The following deals with the minor annoyance that Wow64 FS redirection | 434 // The following deals with the minor annoyance that Wow64 FS redirection |
| 439 // might need to be turned off: This is the case if running as a 32-bit | 435 // might need to be turned off: This is the case if running as a 32-bit |
| 440 // process on a 64-bit system, in which case Wow64 FS redirection redirects | 436 // process on a 64-bit system, in which case Wow64 FS redirection redirects |
| 441 // access to the %WINDIR%/System32/GroupPolicy directory to | 437 // access to the %WINDIR%/System32/GroupPolicy directory to |
| 442 // %WINDIR%/SysWOW64/GroupPolicy, but the file is actually in the | 438 // %WINDIR%/SysWOW64/GroupPolicy, but the file is actually in the |
| 443 // system-native directory. | 439 // system-native directory. |
| 444 if (base::PathExists(preg_file)) { | 440 if (base::PathExists(preg_file)) { |
| 445 return preg_parser::ReadFile(preg_file, chrome_policy_key_, policy, status); | 441 return preg_parser::ReadFile(preg_file, chrome_policy_key_, policy, status); |
| 446 } else { | 442 } else { |
| 447 // Try with redirection switched off. | 443 // Try with redirection switched off. |
| 448 ScopedDisableWow64Redirection redirection_disable; | 444 ScopedDisableWow64Redirection redirection_disable; |
| 449 if (redirection_disable.is_active() && base::PathExists(preg_file)) { | 445 if (redirection_disable.is_active() && base::PathExists(preg_file)) { |
| 450 status->Add(POLICY_LOAD_STATUS_WOW64_REDIRECTION_DISABLED); | 446 status->Add(POLICY_LOAD_STATUS_WOW64_REDIRECTION_DISABLED); |
| 451 return preg_parser::ReadFile(preg_file, chrome_policy_key_, policy, | 447 return preg_parser::ReadFile(preg_file, chrome_policy_key_, policy, |
| 452 status); | 448 status); |
| 453 } | 449 } |
| 454 } | 450 } |
| 455 | 451 |
| 456 // Report the error. | 452 // Report the error. |
| 457 LOG(ERROR) << "PReg file doesn't exist: " << preg_file.value(); | 453 LOG(ERROR) << "PReg file doesn't exist: " << preg_file.value(); |
| 458 status->Add(POLICY_LOAD_STATUS_MISSING); | 454 status->Add(POLICY_LOAD_STATUS_MISSING); |
| 459 return false; | 455 return false; |
| 460 } | 456 } |
| 461 | 457 |
| 462 bool PolicyLoaderWin::LoadGPOPolicy(PolicyScope scope, | 458 bool PolicyLoaderWin::LoadGPOPolicy(PolicyScope scope, |
| 463 PGROUP_POLICY_OBJECT policy_object_list, | 459 PGROUP_POLICY_OBJECT policy_object_list, |
| 464 RegistryDict* policy, | 460 RegistryDict* policy, |
| 465 PolicyLoadStatusSample* status) { | 461 PolicyLoadStatusSampler* status) { |
| 466 RegistryDict parsed_policy; | 462 RegistryDict parsed_policy; |
| 467 RegistryDict forced_policy; | 463 RegistryDict forced_policy; |
| 468 for (GROUP_POLICY_OBJECT* policy_object = policy_object_list; | 464 for (GROUP_POLICY_OBJECT* policy_object = policy_object_list; policy_object; |
| 469 policy_object; policy_object = policy_object->pNext) { | 465 policy_object = policy_object->pNext) { |
| 470 if (policy_object->dwOptions & GPO_FLAG_DISABLE) | 466 if (policy_object->dwOptions & GPO_FLAG_DISABLE) |
| 471 continue; | 467 continue; |
| 472 | 468 |
| 473 if (PathIsUNC(policy_object->lpFileSysPath)) { | 469 if (PathIsUNC(policy_object->lpFileSysPath)) { |
| 474 // UNC path: Assume this is an AD-managed machine, which updates the | 470 // UNC path: Assume this is an AD-managed machine, which updates the |
| 475 // registry via GPO's standard registry CSE periodically. Fall back to | 471 // registry via GPO's standard registry CSE periodically. Fall back to |
| 476 // reading from the registry in this case. | 472 // reading from the registry in this case. |
| 477 status->Add(POLICY_LOAD_STATUS_INACCCESSIBLE); | 473 status->Add(POLICY_LOAD_STATUS_INACCCESSIBLE); |
| 478 return false; | 474 return false; |
| 479 } | 475 } |
| (...skipping 23 matching lines...) Expand all Loading... |
| 503 // this, use only one dict and call ReadPRegFile in the proper order (forced | 499 // this, use only one dict and call ReadPRegFile in the proper order (forced |
| 504 // last). See crbug.com/659979. | 500 // last). See crbug.com/659979. |
| 505 parsed_policy.Merge(forced_policy); | 501 parsed_policy.Merge(forced_policy); |
| 506 policy->Swap(&parsed_policy); | 502 policy->Swap(&parsed_policy); |
| 507 | 503 |
| 508 return true; | 504 return true; |
| 509 } | 505 } |
| 510 | 506 |
| 511 bool PolicyLoaderWin::ReadPolicyFromGPO(PolicyScope scope, | 507 bool PolicyLoaderWin::ReadPolicyFromGPO(PolicyScope scope, |
| 512 RegistryDict* policy, | 508 RegistryDict* policy, |
| 513 PolicyLoadStatusSample* status) { | 509 PolicyLoadStatusSampler* status) { |
| 514 PGROUP_POLICY_OBJECT policy_object_list = NULL; | 510 PGROUP_POLICY_OBJECT policy_object_list = NULL; |
| 515 DWORD flags = scope == POLICY_SCOPE_MACHINE ? GPO_LIST_FLAG_MACHINE : 0; | 511 DWORD flags = scope == POLICY_SCOPE_MACHINE ? GPO_LIST_FLAG_MACHINE : 0; |
| 516 if (gpo_provider_->GetAppliedGPOList( | 512 if (gpo_provider_->GetAppliedGPOList(flags, NULL, NULL, |
| 517 flags, NULL, NULL, &kRegistrySettingsCSEGUID, | 513 &kRegistrySettingsCSEGUID, |
| 518 &policy_object_list) != ERROR_SUCCESS) { | 514 &policy_object_list) != ERROR_SUCCESS) { |
| 519 PLOG(ERROR) << "GetAppliedGPOList scope " << scope; | 515 PLOG(ERROR) << "GetAppliedGPOList scope " << scope; |
| 520 status->Add(POLICY_LOAD_STATUS_QUERY_FAILED); | 516 status->Add(POLICY_LOAD_STATUS_QUERY_FAILED); |
| 521 return false; | 517 return false; |
| 522 } | 518 } |
| 523 | 519 |
| 524 bool result = true; | 520 bool result = true; |
| 525 if (policy_object_list) { | 521 if (policy_object_list) { |
| 526 result = LoadGPOPolicy(scope, policy_object_list, policy, status); | 522 result = LoadGPOPolicy(scope, policy_object_list, policy, status); |
| 527 if (!gpo_provider_->FreeGPOList(policy_object_list)) | 523 if (!gpo_provider_->FreeGPOList(policy_object_list)) |
| 528 LOG(WARNING) << "FreeGPOList"; | 524 LOG(WARNING) << "FreeGPOList"; |
| (...skipping 17 matching lines...) Expand all Loading... |
| 546 } | 542 } |
| 547 | 543 |
| 548 void PolicyLoaderWin::Load3rdPartyPolicy(const RegistryDict* gpo_dict, | 544 void PolicyLoaderWin::Load3rdPartyPolicy(const RegistryDict* gpo_dict, |
| 549 PolicyScope scope, | 545 PolicyScope scope, |
| 550 PolicyBundle* bundle) { | 546 PolicyBundle* bundle) { |
| 551 // Map of known 3rd party policy domain name to their enum values. | 547 // Map of known 3rd party policy domain name to their enum values. |
| 552 static const struct { | 548 static const struct { |
| 553 const char* name; | 549 const char* name; |
| 554 PolicyDomain domain; | 550 PolicyDomain domain; |
| 555 } k3rdPartyDomains[] = { | 551 } k3rdPartyDomains[] = { |
| 556 { "extensions", POLICY_DOMAIN_EXTENSIONS }, | 552 {"extensions", POLICY_DOMAIN_EXTENSIONS}, |
| 557 }; | 553 }; |
| 558 | 554 |
| 559 // Policy level and corresponding path. | 555 // Policy level and corresponding path. |
| 560 static const struct { | 556 static const struct { |
| 561 PolicyLevel level; | 557 PolicyLevel level; |
| 562 const char* path; | 558 const char* path; |
| 563 } kLevels[] = { | 559 } kLevels[] = { |
| 564 { POLICY_LEVEL_MANDATORY, kKeyMandatory }, | 560 {POLICY_LEVEL_MANDATORY, kKeyMandatory}, |
| 565 { POLICY_LEVEL_RECOMMENDED, kKeyRecommended }, | 561 {POLICY_LEVEL_RECOMMENDED, kKeyRecommended}, |
| 566 }; | 562 }; |
| 567 | 563 |
| 568 for (size_t i = 0; i < arraysize(k3rdPartyDomains); i++) { | 564 for (size_t i = 0; i < arraysize(k3rdPartyDomains); i++) { |
| 569 const char* name = k3rdPartyDomains[i].name; | 565 const char* name = k3rdPartyDomains[i].name; |
| 570 const PolicyDomain domain = k3rdPartyDomains[i].domain; | 566 const PolicyDomain domain = k3rdPartyDomains[i].domain; |
| 571 const RegistryDict* domain_dict = gpo_dict->GetKey(name); | 567 const RegistryDict* domain_dict = gpo_dict->GetKey(name); |
| 572 if (!domain_dict) | 568 if (!domain_dict) |
| 573 continue; | 569 continue; |
| 574 | 570 |
| 575 for (RegistryDict::KeyMap::const_iterator component( | 571 for (RegistryDict::KeyMap::const_iterator component( |
| 576 domain_dict->keys().begin()); | 572 domain_dict->keys().begin()); |
| 577 component != domain_dict->keys().end(); | 573 component != domain_dict->keys().end(); ++component) { |
| 578 ++component) { | |
| 579 const PolicyNamespace policy_namespace(domain, component->first); | 574 const PolicyNamespace policy_namespace(domain, component->first); |
| 580 | 575 |
| 581 const Schema* schema_from_map = schema_map()->GetSchema(policy_namespace); | 576 const Schema* schema_from_map = schema_map()->GetSchema(policy_namespace); |
| 582 if (!schema_from_map) { | 577 if (!schema_from_map) { |
| 583 // This extension isn't installed or doesn't support policies. | 578 // This extension isn't installed or doesn't support policies. |
| 584 continue; | 579 continue; |
| 585 } | 580 } |
| 586 Schema schema = *schema_from_map; | 581 Schema schema = *schema_from_map; |
| 587 | 582 |
| 588 // Parse policy. | 583 // Parse policy. |
| (...skipping 25 matching lines...) Expand all Loading... |
| 614 !machine_policy_watcher_.StartWatchingOnce( | 609 !machine_policy_watcher_.StartWatchingOnce( |
| 615 machine_policy_changed_event_.handle(), this)) { | 610 machine_policy_changed_event_.handle(), this)) { |
| 616 DLOG(WARNING) << "Failed to start watch for machine policy change event"; | 611 DLOG(WARNING) << "Failed to start watch for machine policy change event"; |
| 617 machine_policy_watcher_failed_ = true; | 612 machine_policy_watcher_failed_ = true; |
| 618 } | 613 } |
| 619 } | 614 } |
| 620 | 615 |
| 621 void PolicyLoaderWin::OnObjectSignaled(HANDLE object) { | 616 void PolicyLoaderWin::OnObjectSignaled(HANDLE object) { |
| 622 DCHECK(object == user_policy_changed_event_.handle() || | 617 DCHECK(object == user_policy_changed_event_.handle() || |
| 623 object == machine_policy_changed_event_.handle()) | 618 object == machine_policy_changed_event_.handle()) |
| 624 << "unexpected object signaled policy reload, obj = " | 619 << "unexpected object signaled policy reload, obj = " << std::showbase |
| 625 << std::showbase << std::hex << object; | 620 << std::hex << object; |
| 626 Reload(false); | 621 Reload(false); |
| 627 } | 622 } |
| 628 | 623 |
| 629 } // namespace policy | 624 } // namespace policy |
| OLD | NEW |