OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ |
6 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ | 6 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <set> | |
10 #include <string> | 9 #include <string> |
11 | 10 |
12 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
13 #include "base/compiler_specific.h" | 12 #include "base/compiler_specific.h" |
14 #include "base/memory/ref_counted.h" | 13 #include "base/memory/ref_counted.h" |
15 #include "base/memory/scoped_ptr.h" | 14 #include "base/memory/scoped_ptr.h" |
16 #include "base/memory/weak_ptr.h" | 15 #include "base/memory/weak_ptr.h" |
17 #include "base/observer_list.h" | 16 #include "base/observer_list.h" |
18 #include "chrome/browser/chromeos/extensions/device_local_account_external_polic
y_loader.h" | |
19 #include "chrome/browser/chromeos/settings/cros_settings.h" | 17 #include "chrome/browser/chromeos/settings/cros_settings.h" |
20 #include "chrome/browser/policy/cloud/cloud_policy_core.h" | 18 #include "chrome/browser/policy/cloud/cloud_policy_core.h" |
21 #include "chrome/browser/policy/cloud/cloud_policy_store.h" | 19 #include "chrome/browser/policy/cloud/cloud_policy_store.h" |
22 | 20 |
23 namespace base { | 21 namespace base { |
24 class SequencedTaskRunner; | 22 class SequencedTaskRunner; |
25 } | 23 } |
26 | 24 |
27 namespace chromeos { | 25 namespace chromeos { |
| 26 class CrosSettings; |
28 class DeviceSettingsService; | 27 class DeviceSettingsService; |
29 class SessionManagerClient; | 28 class SessionManagerClient; |
30 } | 29 } |
31 | 30 |
32 namespace policy { | 31 namespace policy { |
33 | 32 |
34 struct DeviceLocalAccount; | 33 class CloudPolicyClient; |
35 class DeviceLocalAccountPolicyStore; | 34 class DeviceLocalAccountPolicyStore; |
36 class DeviceManagementService; | 35 class DeviceManagementService; |
37 | 36 |
38 // The main switching central that downloads, caches, refreshes, etc. policy for | 37 // The main switching central that downloads, caches, refreshes, etc. policy for |
39 // a single device-local account. | 38 // a single device-local account. |
40 class DeviceLocalAccountPolicyBroker { | 39 class DeviceLocalAccountPolicyBroker { |
41 public: | 40 public: |
42 // |task_runner| is the runner for policy refresh tasks. | 41 // |task_runner| is the runner for policy refresh tasks. |
43 DeviceLocalAccountPolicyBroker( | 42 explicit DeviceLocalAccountPolicyBroker( |
44 const DeviceLocalAccount& account, | 43 const std::string& user_id, |
45 scoped_ptr<DeviceLocalAccountPolicyStore> store, | 44 scoped_ptr<DeviceLocalAccountPolicyStore> store, |
46 const scoped_refptr<base::SequencedTaskRunner>& task_runner); | 45 const scoped_refptr<base::SequencedTaskRunner>& task_runner); |
47 ~DeviceLocalAccountPolicyBroker(); | 46 ~DeviceLocalAccountPolicyBroker(); |
48 | 47 |
49 // Initialize the broker, loading its |store_|. | |
50 void Initialize(); | |
51 | |
52 // For the difference between |account_id| and |user_id|, see the | |
53 // documentation of DeviceLocalAccount. | |
54 const std::string& account_id() const { return account_id_; } | |
55 const std::string& user_id() const { return user_id_; } | 48 const std::string& user_id() const { return user_id_; } |
56 | 49 |
57 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader> | |
58 extension_loader() const { return extension_loader_; } | |
59 | |
60 CloudPolicyCore* core() { return &core_; } | 50 CloudPolicyCore* core() { return &core_; } |
61 const CloudPolicyCore* core() const { return &core_; } | 51 const CloudPolicyCore* core() const { return &core_; } |
62 | 52 |
63 // Fire up the cloud connection for fetching policy for the account from the | 53 // Establish a cloud connection for the service. |
64 // cloud if this is an enterprise-managed device. | 54 void Connect(scoped_ptr<CloudPolicyClient> client); |
65 void ConnectIfPossible( | |
66 chromeos::DeviceSettingsService* device_settings_service, | |
67 DeviceManagementService* device_management_service); | |
68 | 55 |
69 // Destroy the cloud connection, stopping policy refreshes. | 56 // Destroy the cloud connection, stopping policy refreshes. |
70 void Disconnect(); | 57 void Disconnect(); |
71 | 58 |
72 // Reads the refresh delay from policy and configures the refresh scheduler. | 59 // Reads the refresh delay from policy and configures the refresh scheduler. |
73 void UpdateRefreshDelay(); | 60 void UpdateRefreshDelay(); |
74 | 61 |
75 // Retrieves the display name for the account as stored in policy. Returns an | 62 // Retrieves the display name for the account as stored in policy. Returns an |
76 // empty string if the policy is not present. | 63 // empty string if the policy is not present. |
77 std::string GetDisplayName() const; | 64 std::string GetDisplayName() const; |
78 | 65 |
79 private: | 66 private: |
80 const std::string account_id_; | |
81 const std::string user_id_; | 67 const std::string user_id_; |
82 const scoped_ptr<DeviceLocalAccountPolicyStore> store_; | 68 scoped_ptr<DeviceLocalAccountPolicyStore> store_; |
83 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader> | |
84 extension_loader_; | |
85 CloudPolicyCore core_; | 69 CloudPolicyCore core_; |
86 | 70 |
87 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyBroker); | 71 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyBroker); |
88 }; | 72 }; |
89 | 73 |
90 // Manages user policy blobs for device-local accounts present on the device. | 74 // Manages user policy blobs for device-local accounts present on the device. |
91 // The actual policy blobs are brokered by session_manager (to prevent file | 75 // The actual policy blobs are brokered by session_manager (to prevent file |
92 // manipulation), and we're making signature checks on the policy blobs to | 76 // manipulation), and we're making signature checks on the policy blobs to |
93 // ensure they're issued by the device owner. | 77 // ensure they're issued by the device owner. |
94 class DeviceLocalAccountPolicyService : public CloudPolicyStore::Observer { | 78 class DeviceLocalAccountPolicyService : public CloudPolicyStore::Observer { |
95 public: | 79 public: |
96 // Interface for interested parties to observe policy changes. | 80 // Interface for interested parties to observe policy changes. |
97 class Observer { | 81 class Observer { |
98 public: | 82 public: |
99 virtual ~Observer() {} | 83 virtual ~Observer() {} |
100 | 84 |
101 // Policy for the given |user_id| has changed. | 85 // Policy for the given |user_id| has changed. |
102 virtual void OnPolicyUpdated(const std::string& user_id) = 0; | 86 virtual void OnPolicyUpdated(const std::string& user_id) = 0; |
103 | 87 |
104 // The list of accounts has been updated. | 88 // The list of accounts has been updated. |
105 virtual void OnDeviceLocalAccountsChanged() = 0; | 89 virtual void OnDeviceLocalAccountsChanged() = 0; |
106 }; | 90 }; |
107 | 91 |
108 DeviceLocalAccountPolicyService( | 92 DeviceLocalAccountPolicyService( |
109 chromeos::SessionManagerClient* session_manager_client, | 93 chromeos::SessionManagerClient* session_manager_client, |
110 chromeos::DeviceSettingsService* device_settings_service, | 94 chromeos::DeviceSettingsService* device_settings_service, |
111 chromeos::CrosSettings* cros_settings, | 95 chromeos::CrosSettings* cros_settings, |
112 scoped_refptr<base::SequencedTaskRunner> store_background_task_runner, | 96 scoped_refptr<base::SequencedTaskRunner> background_task_runner); |
113 scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner); | |
114 virtual ~DeviceLocalAccountPolicyService(); | 97 virtual ~DeviceLocalAccountPolicyService(); |
115 | 98 |
116 // Initializes the cloud policy service connection. | 99 // Initializes the cloud policy service connection. |
117 void Connect(DeviceManagementService* device_management_service); | 100 void Connect(DeviceManagementService* device_management_service); |
118 | 101 |
119 // Prevents further policy fetches from the cloud. | 102 // Prevents further policy fetches from the cloud. |
120 void Disconnect(); | 103 void Disconnect(); |
121 | 104 |
122 // Get the policy broker for a given |user_id|. Returns NULL if that |user_id| | 105 // Get the policy broker for a given |user_id|. Returns NULL if that |user_id| |
123 // does not belong to an existing device-local account. | 106 // does not belong to an existing device-local account. |
124 DeviceLocalAccountPolicyBroker* GetBrokerForUser(const std::string& user_id); | 107 DeviceLocalAccountPolicyBroker* GetBrokerForUser(const std::string& user_id); |
125 | 108 |
126 // Indicates whether policy has been successfully fetched for the given | 109 // Indicates whether policy has been successfully fetched for the given |
127 // |user_id|. | 110 // |user_id|. |
128 bool IsPolicyAvailableForUser(const std::string& user_id); | 111 bool IsPolicyAvailableForUser(const std::string& user_id); |
129 | 112 |
130 void AddObserver(Observer* observer); | 113 void AddObserver(Observer* observer); |
131 void RemoveObserver(Observer* observer); | 114 void RemoveObserver(Observer* observer); |
132 | 115 |
133 // CloudPolicyStore::Observer: | 116 // CloudPolicyStore::Observer: |
134 virtual void OnStoreLoaded(CloudPolicyStore* store) OVERRIDE; | 117 virtual void OnStoreLoaded(CloudPolicyStore* store) OVERRIDE; |
135 virtual void OnStoreError(CloudPolicyStore* store) OVERRIDE; | 118 virtual void OnStoreError(CloudPolicyStore* store) OVERRIDE; |
136 | 119 |
137 private: | 120 private: |
138 typedef std::map<std::string, DeviceLocalAccountPolicyBroker*> | 121 struct PolicyBrokerWrapper { |
139 PolicyBrokerMap; | 122 PolicyBrokerWrapper(); |
| 123 ~PolicyBrokerWrapper(); |
140 | 124 |
141 // Returns |true| if the directory in which force-installed extensions are | 125 // Return the |broker|, creating it first if necessary. |
142 // cached for |account_id| is busy, either because a broker that was using | 126 DeviceLocalAccountPolicyBroker* GetBroker(); |
143 // this directory has not shut down completely yet or because the directory is | |
144 // being deleted. | |
145 bool IsExtensionCacheDirectoryBusy(const std::string& account_id); | |
146 | 127 |
147 // Starts any extension caches that are not running yet but can be started now | 128 // Fire up the cloud connection for fetching policy for the account from the |
148 // because their cache directories are no longer busy. | 129 // cloud if this is an enterprise-managed device. |
149 void StartExtensionCachesIfPossible(); | 130 void ConnectIfPossible(); |
150 | 131 |
151 // Checks whether a broker exists for |account_id|. If so, starts the broker's | 132 // Destroy the cloud connection. |
152 // extension cache and returns |true|. Otherwise, returns |false|. | 133 void Disconnect(); |
153 bool StartExtensionCacheForAccountIfPresent(const std::string& account_id); | |
154 | 134 |
155 // Called back when any extension caches belonging to device-local accounts | 135 // Delete the broker. |
156 // that no longer exist have been removed at start-up. | 136 void DeleteBroker(); |
157 void OnOrphanedExtensionCachesDeleted(); | |
158 | 137 |
159 // Called back when the extension cache for |account_id| has been shut down. | 138 std::string user_id; |
160 void OnObsoleteExtensionCacheShutdown(const std::string& account_id); | 139 std::string account_id; |
| 140 DeviceLocalAccountPolicyService* parent; |
| 141 DeviceLocalAccountPolicyBroker* broker; |
| 142 scoped_refptr<base::SequencedTaskRunner> background_task_runner; |
| 143 }; |
161 | 144 |
162 // Called back when the extension cache for |account_id| has been removed. | 145 typedef std::map<std::string, PolicyBrokerWrapper> PolicyBrokerMap; |
163 void OnObsoleteExtensionCacheDeleted(const std::string& account_id); | |
164 | 146 |
165 // Re-queries the list of defined device-local accounts from device settings | 147 // Re-queries the list of defined device-local accounts from device settings |
166 // and updates |policy_brokers_| to match that list. | 148 // and updates |policy_brokers_| to match that list. |
167 void UpdateAccountList(); | 149 void UpdateAccountList(); |
168 | 150 |
169 // Calls |UpdateAccountList| if there are no previous calls pending. | 151 // Calls |UpdateAccountList| if there are no previous calls pending. |
170 void UpdateAccountListIfNonePending(); | 152 void UpdateAccountListIfNonePending(); |
171 | 153 |
172 // Deletes brokers in |map| and clears it. | 154 // Deletes brokers in |map| and clears it. |
173 void DeleteBrokers(PolicyBrokerMap* map); | 155 void DeleteBrokers(PolicyBrokerMap* map); |
174 | 156 |
175 // Find the broker for a given |store|. Returns NULL if |store| is unknown. | 157 // Find the broker for a given |store|. Returns NULL if |store| is unknown. |
176 DeviceLocalAccountPolicyBroker* GetBrokerForStore(CloudPolicyStore* store); | 158 DeviceLocalAccountPolicyBroker* GetBrokerForStore(CloudPolicyStore* store); |
177 | 159 |
178 chromeos::SessionManagerClient* session_manager_client_; | 160 chromeos::SessionManagerClient* session_manager_client_; |
179 chromeos::DeviceSettingsService* device_settings_service_; | 161 chromeos::DeviceSettingsService* device_settings_service_; |
180 chromeos::CrosSettings* cros_settings_; | 162 chromeos::CrosSettings* cros_settings_; |
181 | 163 |
182 DeviceManagementService* device_management_service_; | 164 DeviceManagementService* device_management_service_; |
183 | 165 |
184 // The device-local account policy brokers, keyed by user ID. | 166 // The device-local account policy brokers, keyed by user ID. |
185 PolicyBrokerMap policy_brokers_; | 167 PolicyBrokerMap policy_brokers_; |
186 | 168 |
187 // Whether a call to UpdateAccountList() is pending because |cros_settings_| | |
188 // are not trusted yet. | |
189 bool waiting_for_cros_settings_; | |
190 | |
191 // Orphaned extension caches are removed at startup. This tracks the status of | |
192 // that process. | |
193 enum OrphanCacheDeletionState { | |
194 NOT_STARTED, | |
195 IN_PROGRESS, | |
196 DONE, | |
197 }; | |
198 OrphanCacheDeletionState orphan_cache_deletion_state_; | |
199 | |
200 // Account IDs whose extension cache directories are busy, either because a | |
201 // broker for the account has not shut down completely yet or because the | |
202 // directory is being deleted. | |
203 std::set<std::string> busy_extension_cache_directories_; | |
204 | |
205 const scoped_refptr<base::SequencedTaskRunner> store_background_task_runner_; | |
206 const scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner_; | |
207 | |
208 ObserverList<Observer, true> observers_; | 169 ObserverList<Observer, true> observers_; |
209 | 170 |
210 const scoped_ptr<chromeos::CrosSettings::ObserverSubscription> | 171 scoped_ptr<chromeos::CrosSettings::ObserverSubscription> |
211 local_accounts_subscription_; | 172 local_accounts_subscription_; |
212 | 173 |
213 base::WeakPtrFactory<DeviceLocalAccountPolicyService> weak_factory_; | 174 scoped_refptr<base::SequencedTaskRunner> background_task_runner_; |
| 175 |
| 176 // Weak pointer factory for cros_settings_->PrepareTrustedValues() callbacks. |
| 177 base::WeakPtrFactory<DeviceLocalAccountPolicyService> |
| 178 cros_settings_callback_factory_; |
214 | 179 |
215 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyService); | 180 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyService); |
216 }; | 181 }; |
217 | 182 |
218 } // namespace policy | 183 } // namespace policy |
219 | 184 |
220 #endif // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ | 185 #endif // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ |
OLD | NEW |