Enable policy-imported root CA certificates for kiosk and AD sessions

chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_network_configuration_updater_factory.h"
 
 #include "base/memory/singleton.h"
 #include "chrome/browser/chromeos/policy/user_network_configuration_updater.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/policy/profile_policy_connector.h"
@@ skipping 54 matching lines @@
     return NULL;  // On the login screen only device network policies apply.
 
   const user_manager::User* user =
       chromeos::ProfileHelper::Get()->GetUserByProfile(profile);
   DCHECK(user);
   // Currently, only the network policy of the primary user is supported. See
   // also http://crbug.com/310685 .
   if (user != user_manager::UserManager::Get()->GetPrimaryUser())
     return NULL;
 
-  const bool allow_trusted_certs_from_policy = user->HasGaiaAccount();
+  // Disallow trusted root certs for public sessions.
+  const bool allow_trusted_certs_from_policy =
+      user->GetType() != user_manager::USER_TYPE_PUBLIC_ACCOUNT;

[Andrew T Wilson (Slow), 2017/05/17 15:03:54]

To be clear - what behavior does this expose for guest sessions?

[pmarko, 2017/05/17 15:18:07]

This is only relevant for user policy, and guest sessions don't have user
policy.
Do you think a comment is enough here or should we exclude USER_GUEST just to be
sure?

 
   ProfilePolicyConnector* profile_connector =
       ProfilePolicyConnectorFactory::GetForBrowserContext(context);
 
   return UserNetworkConfigurationUpdater::CreateForUserPolicy(
       profile,
       allow_trusted_certs_from_policy,
       *user,
       profile_connector->policy_service(),
       chromeos::NetworkHandler::Get()->managed_network_configuration_handler())
       .release();
 }
 
 }  // namespace policy