Policy implementation for encryptfs to ext4 migration strategy

chrome/browser/chromeos/login/startup_utils.cc

Index: chrome/browser/chromeos/login/startup_utils.cc
diff --git a/chrome/browser/chromeos/login/startup_utils.cc b/chrome/browser/chromeos/login/startup_utils.cc
index 34877c4da3e306804c74d7da8d44117f84d0a027..1d4bc84ac125278d0c9119dcf399d5620545dba9 100644
--- a/chrome/browser/chromeos/login/startup_utils.cc
+++ b/chrome/browser/chromeos/login/startup_utils.cc
@@ -12,9 +12,12 @@
 #include "base/threading/thread_restrictions.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
+#include "chrome/browser/chromeos/settings/device_settings_service.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/chromeos_switches.h"
+#include "components/arc/arc_util.h"
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
 #include "components/web_resource/web_resource_pref_names.h"
@@ -228,4 +231,38 @@ base::Time StartupUtils::GetTimeOfLastUpdateCheckWithoutUpdate() {
           prefs::kOobeTimeOfLastUpdateCheckWithoutUpdate));
 }
 
+// static
+void StartupUtils::SetExt4MigrationForArcAllowed() {

[hidehiko, 2017/05/25 12:41:55]

Calling this function in various places sounds not a good for maintenance.
When exactly this can be called? Could you call exact once in the
initialization?

Note that; my understanding is the value could be fixed at very beginning of
chrome. If not, please let me know.

[igorcov, 2017/05/31 17:25:35]

You are right, that's a good point. I've changed to check the Prefs. Those are
updated when the policy is loaded.

+  // If the policy was set already, exit. For migration after policy update, a
+  // restart is needed.
+  if (arc::GetArcAvailabilityPolicyStatus() !=
+      arc::ARC_AVAILABILITY_POLICY_STATUS::UNKNOWN)
+    return;
+
+  policy::BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  if (!connector->IsEnterpriseManaged()) {
+    arc::SetArcAvailabilityPolicyStatus(
+        arc::ARC_AVAILABILITY_POLICY_STATUS::AVAILABLE);
+    return;
+  }
+
+  const enterprise_management::ChromeDeviceSettingsProto* policy =

[hidehiko, 2017/05/25 12:41:55]

nit: auto help to shorten the code. Something like.

const auto* device_settings =
    chromeos::DeviceSettingsService::Get()->device_settings();
if (!policy || !policy->has_device_ecryptfs_migration_strategy()) {
  // Set some value.
  return;
}

const auto& container = policy->device_ecryptfs_migration_strategy();
bool is_available =
    container.has_migration_strategy() &&
    container.migration_strategy() == ALLOW_MIGRATION;
arc::SetArcAvailablilityPolicyStatus(
    is_available ? AVAILABLE : DISABLED);

+      chromeos::DeviceSettingsService::Get()->device_settings();
+  if (policy && policy->has_device_ecryptfs_migration_strategy()) {
+    const enterprise_management::DeviceEcryptfsMigrationStrategyProto&
+        container(policy->device_ecryptfs_migration_strategy());
+    if (container.has_migration_strategy() &&
+        container.migration_strategy() ==
+            enterprise_management::DeviceEcryptfsMigrationStrategyProto::
+                ALLOW_MIGRATION) {
+      arc::SetArcAvailabilityPolicyStatus(
+          arc::ARC_AVAILABILITY_POLICY_STATUS::AVAILABLE);
+    } else {
+      arc::SetArcAvailabilityPolicyStatus(
+          arc::ARC_AVAILABILITY_POLICY_STATUS::DISABLED);
+    }
+  }

[hidehiko, 2017/05/25 12:41:55]

What value should be assigned in case of no proto?

[igorcov, 2017/05/31 17:25:35]

The function is called a few times before the policy is loaded. In case there's
no policy data, and there's no sign that the device is consumer owned, the value
should remain UNKNOWN while the function returns false.

+}
+
 }  // namespace chromeos