Enable policy-imported root CA certificates for kiosk and AD sessions

chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc

Index: chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc
diff --git a/chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc b/chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc
index e13ed617a4b8da8a2fe01406cc2e16205422294b..9beac92a3603c5a85a4614c4a2d12386efb4f76c 100644
--- a/chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc
+++ b/chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc
@@ -72,7 +72,9 @@ KeyedService* UserNetworkConfigurationUpdaterFactory::BuildServiceInstanceFor(
   if (user != user_manager::UserManager::Get()->GetPrimaryUser())
     return NULL;
 
-  const bool allow_trusted_certs_from_policy = user->HasGaiaAccount();
+  // Disallow trusted root certs for public sessions.
+  const bool allow_trusted_certs_from_policy =
+      user->GetType() != user_manager::USER_TYPE_PUBLIC_ACCOUNT;

[Andrew T Wilson (Slow), 2017/05/17 15:03:54]

To be clear - what behavior does this expose for guest sessions?

[pmarko, 2017/05/17 15:18:07]

This is only relevant for user policy, and guest sessions don't have user
policy.
Do you think a comment is enough here or should we exclude USER_GUEST just to be
sure?

 
   ProfilePolicyConnector* profile_connector =
       ProfilePolicyConnectorFactory::GetForBrowserContext(context);