Policy implementation for encryptfs to ext4 migration strategy

chrome/browser/chromeos/login/startup_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/startup_utils.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "base/sys_info.h"
 #include "base/threading/thread_restrictions.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
+#include "chrome/browser/chromeos/settings/device_settings_service.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/chromeos_switches.h"
+#include "components/arc/arc_util.h"
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
 #include "components/web_resource/web_resource_pref_names.h"
 #include "content/public/browser/browser_thread.h"
 #include "ui/base/l10n/l10n_util.h"
 
 using content::BrowserThread;
 
 namespace {
 
@@ skipping 193 matching lines @@
   prefs->CommitPendingWrite();
 }
 
 // static
 base::Time StartupUtils::GetTimeOfLastUpdateCheckWithoutUpdate() {
   return base::Time::FromInternalValue(
       g_browser_process->local_state()->GetInt64(
           prefs::kOobeTimeOfLastUpdateCheckWithoutUpdate));
 }
 
+// static
+void StartupUtils::SetExt4MigrationForArcAllowed() {

[hidehiko, 2017/05/25 12:41:55]

Calling this function in various places sounds not a good for maintenance.
When exactly this can be called? Could you call exact once in the
initialization?

Note that; my understanding is the value could be fixed at very beginning of
chrome. If not, please let me know.

[igorcov, 2017/05/31 17:25:35]

You are right, that's a good point. I've changed to check the Prefs. Those are
updated when the policy is loaded.

+  // If the policy was set already, exit. For migration after policy update, a
+  // restart is needed.
+  if (arc::GetArcAvailabilityPolicyStatus() !=
+      arc::ARC_AVAILABILITY_POLICY_STATUS::UNKNOWN)
+    return;
+
+  policy::BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  if (!connector->IsEnterpriseManaged()) {
+    arc::SetArcAvailabilityPolicyStatus(
+        arc::ARC_AVAILABILITY_POLICY_STATUS::AVAILABLE);
+    return;
+  }
+
+  const enterprise_management::ChromeDeviceSettingsProto* policy =

[hidehiko, 2017/05/25 12:41:55]

nit: auto help to shorten the code. Something like.

const auto* device_settings =
    chromeos::DeviceSettingsService::Get()->device_settings();
if (!policy || !policy->has_device_ecryptfs_migration_strategy()) {
  // Set some value.
  return;
}

const auto& container = policy->device_ecryptfs_migration_strategy();
bool is_available =
    container.has_migration_strategy() &&
    container.migration_strategy() == ALLOW_MIGRATION;
arc::SetArcAvailablilityPolicyStatus(
    is_available ? AVAILABLE : DISABLED);

+      chromeos::DeviceSettingsService::Get()->device_settings();
+  if (policy && policy->has_device_ecryptfs_migration_strategy()) {
+    const enterprise_management::DeviceEcryptfsMigrationStrategyProto&
+        container(policy->device_ecryptfs_migration_strategy());
+    if (container.has_migration_strategy() &&
+        container.migration_strategy() ==
+            enterprise_management::DeviceEcryptfsMigrationStrategyProto::
+                ALLOW_MIGRATION) {
+      arc::SetArcAvailabilityPolicyStatus(
+          arc::ARC_AVAILABILITY_POLICY_STATUS::AVAILABLE);
+    } else {
+      arc::SetArcAvailabilityPolicyStatus(
+          arc::ARC_AVAILABILITY_POLICY_STATUS::DISABLED);
+    }
+  }

[hidehiko, 2017/05/25 12:41:55]

What value should be assigned in case of no proto?

[igorcov, 2017/05/31 17:25:35]

The function is called a few times before the policy is loaded. In case there's
no policy data, and there's no sign that the device is consumer owned, the value
should remain UNKNOWN while the function returns false.

+}
+
 }  // namespace chromeos