| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ |
| 6 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ | 6 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <set> | 9 #include <set> |
| 10 #include <string> | 10 #include <string> |
| 11 | 11 |
| 12 #include "base/basictypes.h" | 12 #include "base/basictypes.h" |
| 13 #include "base/callback.h" |
| 13 #include "base/compiler_specific.h" | 14 #include "base/compiler_specific.h" |
| 14 #include "base/files/file_path.h" | 15 #include "base/files/file_path.h" |
| 15 #include "base/memory/ref_counted.h" | 16 #include "base/memory/ref_counted.h" |
| 16 #include "base/memory/scoped_ptr.h" | 17 #include "base/memory/scoped_ptr.h" |
| 17 #include "base/memory/weak_ptr.h" | 18 #include "base/memory/weak_ptr.h" |
| 18 #include "base/observer_list.h" | 19 #include "base/observer_list.h" |
| 19 #include "chrome/browser/chromeos/extensions/device_local_account_external_polic
y_loader.h" | 20 #include "chrome/browser/chromeos/extensions/device_local_account_external_polic
y_loader.h" |
| 20 #include "chrome/browser/chromeos/policy/device_local_account_external_data_mana
ger.h" | 21 #include "chrome/browser/chromeos/policy/device_local_account_external_data_mana
ger.h" |
| 21 #include "chrome/browser/chromeos/settings/cros_settings.h" | 22 #include "chrome/browser/chromeos/settings/cros_settings.h" |
| 22 #include "components/policy/core/common/cloud/cloud_policy_core.h" | 23 #include "components/policy/core/common/cloud/cloud_policy_core.h" |
| 23 #include "components/policy/core/common/cloud/cloud_policy_store.h" | 24 #include "components/policy/core/common/cloud/cloud_policy_store.h" |
| 25 #include "components/policy/core/common/cloud/component_cloud_policy_service.h" |
| 26 #include "components/policy/core/common/schema_registry.h" |
| 24 | 27 |
| 25 namespace base { | 28 namespace base { |
| 26 class SequencedTaskRunner; | 29 class SequencedTaskRunner; |
| 27 } | 30 } |
| 28 | 31 |
| 29 namespace chromeos { | 32 namespace chromeos { |
| 30 class DeviceSettingsService; | 33 class DeviceSettingsService; |
| 31 class SessionManagerClient; | 34 class SessionManagerClient; |
| 32 } | 35 } |
| 33 | 36 |
| 34 namespace net { | 37 namespace net { |
| 35 class URLRequestContextGetter; | 38 class URLRequestContextGetter; |
| 36 } | 39 } |
| 37 | 40 |
| 38 namespace policy { | 41 namespace policy { |
| 39 | 42 |
| 40 struct DeviceLocalAccount; | 43 struct DeviceLocalAccount; |
| 41 class DeviceLocalAccountExternalDataService; | 44 class DeviceLocalAccountExternalDataService; |
| 42 class DeviceLocalAccountPolicyStore; | 45 class DeviceLocalAccountPolicyStore; |
| 43 class DeviceManagementService; | 46 class DeviceManagementService; |
| 44 | 47 |
| 45 // The main switching central that downloads, caches, refreshes, etc. policy for | 48 // The main switching central that downloads, caches, refreshes, etc. policy for |
| 46 // a single device-local account. | 49 // a single device-local account. |
| 47 class DeviceLocalAccountPolicyBroker { | 50 class DeviceLocalAccountPolicyBroker |
| 51 : public CloudPolicyStore::Observer, |
| 52 public ComponentCloudPolicyService::Delegate { |
| 48 public: | 53 public: |
| 54 // |policy_update_callback| will be invoked to notify observers that the |
| 55 // policy for |account| has been updated. |
| 49 // |task_runner| is the runner for policy refresh tasks. | 56 // |task_runner| is the runner for policy refresh tasks. |
| 50 DeviceLocalAccountPolicyBroker( | 57 DeviceLocalAccountPolicyBroker( |
| 51 const DeviceLocalAccount& account, | 58 const DeviceLocalAccount& account, |
| 52 const base::FilePath& component_policy_cache_path, | 59 const base::FilePath& component_policy_cache_path, |
| 53 scoped_ptr<DeviceLocalAccountPolicyStore> store, | 60 scoped_ptr<DeviceLocalAccountPolicyStore> store, |
| 54 scoped_refptr<DeviceLocalAccountExternalDataManager> | 61 scoped_refptr<DeviceLocalAccountExternalDataManager> |
| 55 external_data_manager, | 62 external_data_manager, |
| 63 const base::Closure& policy_updated_callback, |
| 56 const scoped_refptr<base::SequencedTaskRunner>& task_runner); | 64 const scoped_refptr<base::SequencedTaskRunner>& task_runner); |
| 57 ~DeviceLocalAccountPolicyBroker(); | 65 virtual ~DeviceLocalAccountPolicyBroker(); |
| 58 | 66 |
| 59 // Initialize the broker, loading its |store_|. | 67 // Initialize the broker, loading its |store_|. |
| 60 void Initialize(); | 68 void Initialize(); |
| 61 | 69 |
| 62 // For the difference between |account_id| and |user_id|, see the | 70 // For the difference between |account_id| and |user_id|, see the |
| 63 // documentation of DeviceLocalAccount. | 71 // documentation of DeviceLocalAccount. |
| 64 const std::string& account_id() const { return account_id_; } | 72 const std::string& account_id() const { return account_id_; } |
| 65 const std::string& user_id() const { return user_id_; } | 73 const std::string& user_id() const { return user_id_; } |
| 66 | 74 |
| 67 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader> | 75 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader> |
| 68 extension_loader() const { return extension_loader_; } | 76 extension_loader() const { return extension_loader_; } |
| 69 | 77 |
| 70 CloudPolicyCore* core() { return &core_; } | 78 CloudPolicyCore* core() { return &core_; } |
| 71 const CloudPolicyCore* core() const { return &core_; } | 79 const CloudPolicyCore* core() const { return &core_; } |
| 72 | 80 |
| 73 scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager() { | 81 scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager() { |
| 74 return external_data_manager_; | 82 return external_data_manager_; |
| 75 } | 83 } |
| 76 | 84 |
| 85 ComponentCloudPolicyService* component_policy_service() const { |
| 86 return component_policy_service_.get(); |
| 87 } |
| 88 |
| 89 SchemaRegistry* schema_registry() { return &schema_registry_; } |
| 90 |
| 77 // Fire up the cloud connection for fetching policy for the account from the | 91 // Fire up the cloud connection for fetching policy for the account from the |
| 78 // cloud if this is an enterprise-managed device. | 92 // cloud if this is an enterprise-managed device. |
| 79 void ConnectIfPossible( | 93 void ConnectIfPossible( |
| 80 chromeos::DeviceSettingsService* device_settings_service, | 94 chromeos::DeviceSettingsService* device_settings_service, |
| 81 DeviceManagementService* device_management_service, | 95 DeviceManagementService* device_management_service, |
| 82 scoped_refptr<net::URLRequestContextGetter> request_context); | 96 scoped_refptr<net::URLRequestContextGetter> request_context); |
| 83 | 97 |
| 84 // Reads the refresh delay from policy and configures the refresh scheduler. | 98 // Reads the refresh delay from policy and configures the refresh scheduler. |
| 85 void UpdateRefreshDelay(); | 99 void UpdateRefreshDelay(); |
| 86 | 100 |
| 87 // Retrieves the display name for the account as stored in policy. Returns an | 101 // Retrieves the display name for the account as stored in policy. Returns an |
| 88 // empty string if the policy is not present. | 102 // empty string if the policy is not present. |
| 89 std::string GetDisplayName() const; | 103 std::string GetDisplayName() const; |
| 90 | 104 |
| 91 // Returns a directory where component policy for this account can be cached. | 105 // CloudPolicyStore::Observer: |
| 92 // The DeviceLocalAccountPolicyService takes care of cleaning up caches of | 106 virtual void OnStoreLoaded(CloudPolicyStore* store) OVERRIDE; |
| 93 // accounts that have been removed. | 107 virtual void OnStoreError(CloudPolicyStore* store) OVERRIDE; |
| 94 base::FilePath GetComponentPolicyCachePath() const; | 108 |
| 109 // ComponentCloudPolicyService::Delegate: |
| 110 virtual void OnComponentCloudPolicyUpdated() OVERRIDE; |
| 95 | 111 |
| 96 private: | 112 private: |
| 113 void CreateComponentCloudPolicyService( |
| 114 const scoped_refptr<net::URLRequestContextGetter>& request_context); |
| 115 |
| 97 const std::string account_id_; | 116 const std::string account_id_; |
| 98 const std::string user_id_; | 117 const std::string user_id_; |
| 99 const base::FilePath component_policy_cache_path_; | 118 const base::FilePath component_policy_cache_path_; |
| 119 SchemaRegistry schema_registry_; |
| 100 const scoped_ptr<DeviceLocalAccountPolicyStore> store_; | 120 const scoped_ptr<DeviceLocalAccountPolicyStore> store_; |
| 101 scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager_; | 121 scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager_; |
| 102 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader> | 122 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader> |
| 103 extension_loader_; | 123 extension_loader_; |
| 104 CloudPolicyCore core_; | 124 CloudPolicyCore core_; |
| 125 scoped_ptr<ComponentCloudPolicyService> component_policy_service_; |
| 126 base::Closure policy_update_callback_; |
| 105 | 127 |
| 106 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyBroker); | 128 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyBroker); |
| 107 }; | 129 }; |
| 108 | 130 |
| 109 // Manages user policy blobs for device-local accounts present on the device. | 131 // Manages user policy blobs for device-local accounts present on the device. |
| 110 // The actual policy blobs are brokered by session_manager (to prevent file | 132 // The actual policy blobs are brokered by session_manager (to prevent file |
| 111 // manipulation), and we're making signature checks on the policy blobs to | 133 // manipulation), and we're making signature checks on the policy blobs to |
| 112 // ensure they're issued by the device owner. | 134 // ensure they're issued by the device owner. |
| 113 class DeviceLocalAccountPolicyService : public CloudPolicyStore::Observer { | 135 class DeviceLocalAccountPolicyService { |
| 114 public: | 136 public: |
| 115 // Interface for interested parties to observe policy changes. | 137 // Interface for interested parties to observe policy changes. |
| 116 class Observer { | 138 class Observer { |
| 117 public: | 139 public: |
| 118 virtual ~Observer() {} | 140 virtual ~Observer() {} |
| 119 | 141 |
| 120 // Policy for the given |user_id| has changed. | 142 // Policy for the given |user_id| has changed. |
| 121 virtual void OnPolicyUpdated(const std::string& user_id) = 0; | 143 virtual void OnPolicyUpdated(const std::string& user_id) = 0; |
| 122 | 144 |
| 123 // The list of accounts has been updated. | 145 // The list of accounts has been updated. |
| 124 virtual void OnDeviceLocalAccountsChanged() = 0; | 146 virtual void OnDeviceLocalAccountsChanged() = 0; |
| 125 | |
| 126 // The given |broker| is about to be destroyed. | |
| 127 virtual void OnBrokerShutdown(DeviceLocalAccountPolicyBroker* broker) {} | |
| 128 }; | 147 }; |
| 129 | 148 |
| 130 DeviceLocalAccountPolicyService( | 149 DeviceLocalAccountPolicyService( |
| 131 chromeos::SessionManagerClient* session_manager_client, | 150 chromeos::SessionManagerClient* session_manager_client, |
| 132 chromeos::DeviceSettingsService* device_settings_service, | 151 chromeos::DeviceSettingsService* device_settings_service, |
| 133 chromeos::CrosSettings* cros_settings, | 152 chromeos::CrosSettings* cros_settings, |
| 134 scoped_refptr<base::SequencedTaskRunner> store_background_task_runner, | 153 scoped_refptr<base::SequencedTaskRunner> store_background_task_runner, |
| 135 scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner, | 154 scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner, |
| 136 scoped_refptr<base::SequencedTaskRunner> | 155 scoped_refptr<base::SequencedTaskRunner> |
| 137 external_data_service_backend_task_runner, | 156 external_data_service_backend_task_runner, |
| 138 scoped_refptr<base::SequencedTaskRunner> io_task_runner, | 157 scoped_refptr<base::SequencedTaskRunner> io_task_runner, |
| 139 scoped_refptr<net::URLRequestContextGetter> request_context); | 158 scoped_refptr<net::URLRequestContextGetter> request_context); |
| 140 virtual ~DeviceLocalAccountPolicyService(); | 159 virtual ~DeviceLocalAccountPolicyService(); |
| 141 | 160 |
| 142 // Shuts down the service and prevents further policy fetches from the cloud. | 161 // Shuts down the service and prevents further policy fetches from the cloud. |
| 143 void Shutdown(); | 162 void Shutdown(); |
| 144 | 163 |
| 145 // Initializes the cloud policy service connection. | 164 // Initializes the cloud policy service connection. |
| 146 void Connect(DeviceManagementService* device_management_service); | 165 void Connect(DeviceManagementService* device_management_service); |
| 147 | 166 |
| 148 // Get the policy broker for a given |user_id|. Returns NULL if that |user_id| | 167 // Get the policy broker for a given |user_id|. Returns NULL if that |user_id| |
| 149 // does not belong to an existing device-local account. | 168 // does not belong to an existing device-local account. |
| 150 DeviceLocalAccountPolicyBroker* GetBrokerForUser(const std::string& user_id); | 169 DeviceLocalAccountPolicyBroker* GetBrokerForUser(const std::string& user_id); |
| 151 | 170 |
| 152 // Indicates whether policy has been successfully fetched for the given | 171 // Indicates whether policy has been successfully fetched for the given |
| 153 // |user_id|. | 172 // |user_id|. |
| 154 bool IsPolicyAvailableForUser(const std::string& user_id); | 173 bool IsPolicyAvailableForUser(const std::string& user_id); |
| 155 | 174 |
| 156 scoped_refptr<net::URLRequestContextGetter> request_context() const; | |
| 157 | |
| 158 void AddObserver(Observer* observer); | 175 void AddObserver(Observer* observer); |
| 159 void RemoveObserver(Observer* observer); | 176 void RemoveObserver(Observer* observer); |
| 160 | 177 |
| 161 // CloudPolicyStore::Observer: | |
| 162 virtual void OnStoreLoaded(CloudPolicyStore* store) OVERRIDE; | |
| 163 virtual void OnStoreError(CloudPolicyStore* store) OVERRIDE; | |
| 164 | |
| 165 private: | 178 private: |
| 166 typedef std::map<std::string, DeviceLocalAccountPolicyBroker*> | 179 typedef std::map<std::string, DeviceLocalAccountPolicyBroker*> |
| 167 PolicyBrokerMap; | 180 PolicyBrokerMap; |
| 168 | 181 |
| 169 // Returns |true| if the directory in which force-installed extensions are | 182 // Returns |true| if the directory in which force-installed extensions are |
| 170 // cached for |account_id| is busy, either because a broker that was using | 183 // cached for |account_id| is busy, either because a broker that was using |
| 171 // this directory has not shut down completely yet or because the directory is | 184 // this directory has not shut down completely yet or because the directory is |
| 172 // being deleted. | 185 // being deleted. |
| 173 bool IsExtensionCacheDirectoryBusy(const std::string& account_id); | 186 bool IsExtensionCacheDirectoryBusy(const std::string& account_id); |
| 174 | 187 |
| (...skipping 21 matching lines...) Expand all Loading... |
| 196 | 209 |
| 197 // Calls |UpdateAccountList| if there are no previous calls pending. | 210 // Calls |UpdateAccountList| if there are no previous calls pending. |
| 198 void UpdateAccountListIfNonePending(); | 211 void UpdateAccountListIfNonePending(); |
| 199 | 212 |
| 200 // Deletes brokers in |map| and clears it. | 213 // Deletes brokers in |map| and clears it. |
| 201 void DeleteBrokers(PolicyBrokerMap* map); | 214 void DeleteBrokers(PolicyBrokerMap* map); |
| 202 | 215 |
| 203 // Find the broker for a given |store|. Returns NULL if |store| is unknown. | 216 // Find the broker for a given |store|. Returns NULL if |store| is unknown. |
| 204 DeviceLocalAccountPolicyBroker* GetBrokerForStore(CloudPolicyStore* store); | 217 DeviceLocalAccountPolicyBroker* GetBrokerForStore(CloudPolicyStore* store); |
| 205 | 218 |
| 219 // Notifies the |observers_| that the policy for |user_id| has changed. |
| 220 void NotifyPolicyUpdated(const std::string& user_id); |
| 221 |
| 206 ObserverList<Observer, true> observers_; | 222 ObserverList<Observer, true> observers_; |
| 207 | 223 |
| 208 chromeos::SessionManagerClient* session_manager_client_; | 224 chromeos::SessionManagerClient* session_manager_client_; |
| 209 chromeos::DeviceSettingsService* device_settings_service_; | 225 chromeos::DeviceSettingsService* device_settings_service_; |
| 210 chromeos::CrosSettings* cros_settings_; | 226 chromeos::CrosSettings* cros_settings_; |
| 211 | 227 |
| 212 DeviceManagementService* device_management_service_; | 228 DeviceManagementService* device_management_service_; |
| 213 | 229 |
| 214 // The device-local account policy brokers, keyed by user ID. | 230 // The device-local account policy brokers, keyed by user ID. |
| 215 PolicyBrokerMap policy_brokers_; | 231 PolicyBrokerMap policy_brokers_; |
| 216 | 232 |
| 217 // Whether a call to UpdateAccountList() is pending because |cros_settings_| | 233 // Whether a call to UpdateAccountList() is pending because |cros_settings_| |
| 218 // are not trusted yet. | 234 // are not trusted yet. |
| 219 bool waiting_for_cros_settings_; | 235 bool waiting_for_cros_settings_; |
| 220 | 236 |
| 221 // Orphaned extension caches are removed at startup. This tracks the status of | 237 // Orphaned extension caches are removed at startup. This tracks the status of |
| 222 // that process. | 238 // that process. |
| 223 enum OrphanCacheDeletionState { | 239 enum OrphanExtensionCacheDeletionState { |
| 224 NOT_STARTED, | 240 NOT_STARTED, |
| 225 IN_PROGRESS, | 241 IN_PROGRESS, |
| 226 DONE, | 242 DONE, |
| 227 }; | 243 }; |
| 228 OrphanCacheDeletionState orphan_cache_deletion_state_; | 244 OrphanExtensionCacheDeletionState orphan_extension_cache_deletion_state_; |
| 229 | 245 |
| 230 // Account IDs whose extension cache directories are busy, either because a | 246 // Account IDs whose extension cache directories are busy, either because a |
| 231 // broker for the account has not shut down completely yet or because the | 247 // broker for the account has not shut down completely yet or because the |
| 232 // directory is being deleted. | 248 // directory is being deleted. |
| 233 std::set<std::string> busy_extension_cache_directories_; | 249 std::set<std::string> busy_extension_cache_directories_; |
| 234 | 250 |
| 235 const scoped_refptr<base::SequencedTaskRunner> store_background_task_runner_; | 251 const scoped_refptr<base::SequencedTaskRunner> store_background_task_runner_; |
| 236 const scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner_; | 252 const scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner_; |
| 237 | 253 |
| 238 scoped_ptr<DeviceLocalAccountExternalDataService> external_data_service_; | 254 scoped_ptr<DeviceLocalAccountExternalDataService> external_data_service_; |
| 239 | 255 |
| 240 scoped_refptr<net::URLRequestContextGetter> request_context_; | 256 scoped_refptr<net::URLRequestContextGetter> request_context_; |
| 241 | 257 |
| 242 const scoped_ptr<chromeos::CrosSettings::ObserverSubscription> | 258 const scoped_ptr<chromeos::CrosSettings::ObserverSubscription> |
| 243 local_accounts_subscription_; | 259 local_accounts_subscription_; |
| 244 | 260 |
| 245 // Path to the directory that contains the cached policies for components | 261 // Path to the directory that contains the cached policy for components |
| 246 // for device local accounts. | 262 // for device-local accounts. |
| 247 base::FilePath component_policy_cache_root_; | 263 base::FilePath component_policy_cache_root_; |
| 248 | 264 |
| 249 base::WeakPtrFactory<DeviceLocalAccountPolicyService> weak_factory_; | 265 base::WeakPtrFactory<DeviceLocalAccountPolicyService> weak_factory_; |
| 250 | 266 |
| 251 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyService); | 267 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyService); |
| 252 }; | 268 }; |
| 253 | 269 |
| 254 } // namespace policy | 270 } // namespace policy |
| 255 | 271 |
| 256 #endif // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ | 272 #endif // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_ |
| OLD | NEW |