OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h" |
6 | 6 |
7 #include "base/bind.h" | 7 #include "base/bind.h" |
8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
9 #include "base/command_line.h" | 9 #include "base/command_line.h" |
10 #include "base/port.h" | 10 #include "base/port.h" |
11 #include "base/prefs/pref_registry_simple.h" | |
12 #include "base/prefs/pref_service.h" | |
13 #include "base/strings/string_number_conversions.h" | 11 #include "base/strings/string_number_conversions.h" |
14 #include "base/time/time.h" | 12 #include "base/time/time.h" |
15 #include "chrome/browser/chromeos/attestation/attestation_policy_observer.h" | 13 #include "chrome/browser/chromeos/attestation/attestation_policy_observer.h" |
16 #include "chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.h" | 14 #include "chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.h" |
17 #include "chrome/browser/chromeos/login/startup_utils.h" | 15 #include "chrome/browser/chromeos/login/startup_utils.h" |
18 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h" | 16 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h" |
19 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h" | 17 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h" |
20 #include "chrome/common/pref_names.h" | 18 #include "chrome/common/pref_names.h" |
21 #include "chromeos/chromeos_constants.h" | 19 #include "chromeos/chromeos_constants.h" |
22 #include "chromeos/chromeos_switches.h" | 20 #include "chromeos/chromeos_switches.h" |
23 #include "chromeos/system/statistics_provider.h" | 21 #include "chromeos/system/statistics_provider.h" |
24 #include "components/policy/core/common/cloud/cloud_policy_store.h" | 22 #include "components/policy/core/common/cloud/cloud_policy_store.h" |
25 #include "content/public/browser/browser_thread.h" | 23 #include "content/public/browser/browser_thread.h" |
26 #include "crypto/sha2.h" | 24 #include "crypto/sha2.h" |
27 #include "policy/proto/device_management_backend.pb.h" | 25 #include "policy/proto/device_management_backend.pb.h" |
28 #include "url/gurl.h" | 26 #include "url/gurl.h" |
29 | 27 |
30 using content::BrowserThread; | 28 using content::BrowserThread; |
31 | 29 |
32 namespace em = enterprise_management; | 30 namespace em = enterprise_management; |
33 | 31 |
34 namespace policy { | 32 namespace policy { |
35 | 33 |
36 namespace { | 34 namespace { |
37 | 35 |
38 const char kNoRequisition[] = "none"; | |
39 const char kRemoraRequisition[] = "remora"; | |
40 const char kSharkRequisition[] = "shark"; | |
41 | |
42 // These are the machine serial number keys that we check in order until we | 36 // These are the machine serial number keys that we check in order until we |
43 // find a non-empty serial number. The VPD spec says the serial number should be | 37 // find a non-empty serial number. The VPD spec says the serial number should be |
44 // in the "serial_number" key for v2+ VPDs. However, legacy devices used a | 38 // in the "serial_number" key for v2+ VPDs. However, legacy devices used a |
45 // different key to report their serial number, which we fall back to if | 39 // different key to report their serial number, which we fall back to if |
46 // "serial_number" is not present. | 40 // "serial_number" is not present. |
47 // | 41 // |
48 // Product_S/N is still special-cased due to inconsistencies with serial | 42 // Product_S/N is still special-cased due to inconsistencies with serial |
49 // numbers on Lumpy devices: On these devices, serial_number is identical to | 43 // numbers on Lumpy devices: On these devices, serial_number is identical to |
50 // Product_S/N with an appended checksum. Unfortunately, the sticker on the | 44 // Product_S/N with an appended checksum. Unfortunately, the sticker on the |
51 // packaging doesn't include that checksum either (the sticker on the device | 45 // packaging doesn't include that checksum either (the sticker on the device |
(...skipping 15 matching lines...) Expand all Loading... |
67 std::string GetMachineStatistic(const std::string& key) { | 61 std::string GetMachineStatistic(const std::string& key) { |
68 std::string value; | 62 std::string value; |
69 chromeos::system::StatisticsProvider* provider = | 63 chromeos::system::StatisticsProvider* provider = |
70 chromeos::system::StatisticsProvider::GetInstance(); | 64 chromeos::system::StatisticsProvider::GetInstance(); |
71 if (!provider->GetMachineStatistic(key, &value)) | 65 if (!provider->GetMachineStatistic(key, &value)) |
72 return std::string(); | 66 return std::string(); |
73 | 67 |
74 return value; | 68 return value; |
75 } | 69 } |
76 | 70 |
77 // Gets a machine flag from StatisticsProvider, returns the given | |
78 // |default_value| if not present. | |
79 bool GetMachineFlag(const std::string& key, bool default_value) { | |
80 bool value = default_value; | |
81 chromeos::system::StatisticsProvider* provider = | |
82 chromeos::system::StatisticsProvider::GetInstance(); | |
83 if (!provider->GetMachineFlag(key, &value)) | |
84 return default_value; | |
85 | |
86 return value; | |
87 } | |
88 | |
89 // Checks whether forced re-enrollment is enabled. | 71 // Checks whether forced re-enrollment is enabled. |
90 bool ForcedReEnrollmentEnabled() { | 72 bool ForcedReEnrollmentEnabled() { |
91 return chromeos::AutoEnrollmentController::GetMode() == | 73 return chromeos::AutoEnrollmentController::GetMode() == |
92 chromeos::AutoEnrollmentController::MODE_FORCED_RE_ENROLLMENT; | 74 chromeos::AutoEnrollmentController::MODE_FORCED_RE_ENROLLMENT; |
93 } | 75 } |
94 | 76 |
95 } // namespace | 77 } // namespace |
96 | 78 |
97 DeviceCloudPolicyManagerChromeOS::DeviceCloudPolicyManagerChromeOS( | 79 DeviceCloudPolicyManagerChromeOS::DeviceCloudPolicyManagerChromeOS( |
98 scoped_ptr<DeviceCloudPolicyStoreChromeOS> store, | 80 scoped_ptr<DeviceCloudPolicyStoreChromeOS> store, |
99 const scoped_refptr<base::SequencedTaskRunner>& task_runner, | 81 const scoped_refptr<base::SequencedTaskRunner>& task_runner, |
100 ServerBackedStateKeysBroker* state_keys_broker) | 82 ServerBackedStateKeysBroker* state_keys_broker) |
101 : CloudPolicyManager( | 83 : CloudPolicyManager( |
102 PolicyNamespaceKey(dm_protocol::kChromeDevicePolicyType, | 84 PolicyNamespaceKey(dm_protocol::kChromeDevicePolicyType, |
103 std::string()), | 85 std::string()), |
104 store.get(), | 86 store.get(), |
105 task_runner, | 87 task_runner, |
106 BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE), | 88 BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE), |
107 BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO)), | 89 BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO)), |
108 device_store_(store.Pass()), | 90 device_store_(store.Pass()), |
109 state_keys_broker_(state_keys_broker), | 91 state_keys_broker_(state_keys_broker) { |
110 local_state_(NULL) { | 92 state_keys_update_subscription_ = state_keys_broker_->RegisterUpdateCallback( |
| 93 base::Bind(&DeviceCloudPolicyManagerChromeOS::OnStateKeysUpdated, |
| 94 base::Unretained(this))); |
111 } | 95 } |
112 | 96 |
113 DeviceCloudPolicyManagerChromeOS::~DeviceCloudPolicyManagerChromeOS() {} | 97 DeviceCloudPolicyManagerChromeOS::~DeviceCloudPolicyManagerChromeOS() {} |
114 | 98 |
115 void DeviceCloudPolicyManagerChromeOS::Initialize(PrefService* local_state) { | |
116 CHECK(local_state); | |
117 | |
118 local_state_ = local_state; | |
119 | |
120 state_keys_update_subscription_ = state_keys_broker_->RegisterUpdateCallback( | |
121 base::Bind(&DeviceCloudPolicyManagerChromeOS::OnStateKeysUpdated, | |
122 base::Unretained(this))); | |
123 | |
124 InitializeRequisition(); | |
125 } | |
126 | |
127 std::string DeviceCloudPolicyManagerChromeOS::GetDeviceRequisition() const { | |
128 std::string requisition; | |
129 const PrefService::Preference* pref = local_state_->FindPreference( | |
130 prefs::kDeviceEnrollmentRequisition); | |
131 if (!pref->IsDefaultValue()) | |
132 pref->GetValue()->GetAsString(&requisition); | |
133 | |
134 if (requisition == kNoRequisition) | |
135 requisition.clear(); | |
136 | |
137 return requisition; | |
138 } | |
139 | |
140 void DeviceCloudPolicyManagerChromeOS::SetDeviceRequisition( | |
141 const std::string& requisition) { | |
142 VLOG(1) << "SetDeviceRequisition " << requisition; | |
143 if (local_state_) { | |
144 if (requisition.empty()) { | |
145 local_state_->ClearPref(prefs::kDeviceEnrollmentRequisition); | |
146 local_state_->ClearPref(prefs::kDeviceEnrollmentAutoStart); | |
147 local_state_->ClearPref(prefs::kDeviceEnrollmentCanExit); | |
148 } else { | |
149 local_state_->SetString(prefs::kDeviceEnrollmentRequisition, requisition); | |
150 if (requisition == kNoRequisition) { | |
151 local_state_->ClearPref(prefs::kDeviceEnrollmentAutoStart); | |
152 local_state_->ClearPref(prefs::kDeviceEnrollmentCanExit); | |
153 } else { | |
154 local_state_->SetBoolean(prefs::kDeviceEnrollmentAutoStart, true); | |
155 local_state_->SetBoolean(prefs::kDeviceEnrollmentCanExit, false); | |
156 } | |
157 } | |
158 } | |
159 } | |
160 | |
161 bool DeviceCloudPolicyManagerChromeOS::IsRemoraRequisition() const { | |
162 return GetDeviceRequisition() == kRemoraRequisition; | |
163 } | |
164 | |
165 bool DeviceCloudPolicyManagerChromeOS::IsSharkRequisition() const { | |
166 return GetDeviceRequisition() == kSharkRequisition; | |
167 } | |
168 | |
169 void DeviceCloudPolicyManagerChromeOS::Shutdown() { | 99 void DeviceCloudPolicyManagerChromeOS::Shutdown() { |
170 state_keys_update_subscription_.reset(); | 100 state_keys_update_subscription_.reset(); |
171 CloudPolicyManager::Shutdown(); | 101 CloudPolicyManager::Shutdown(); |
172 } | 102 } |
173 | 103 |
174 // static | 104 // static |
175 void DeviceCloudPolicyManagerChromeOS::RegisterPrefs( | |
176 PrefRegistrySimple* registry) { | |
177 registry->RegisterStringPref(prefs::kDeviceEnrollmentRequisition, | |
178 std::string()); | |
179 registry->RegisterBooleanPref(prefs::kDeviceEnrollmentAutoStart, false); | |
180 registry->RegisterBooleanPref(prefs::kDeviceEnrollmentCanExit, true); | |
181 registry->RegisterDictionaryPref(prefs::kServerBackedDeviceState); | |
182 } | |
183 | |
184 // static | |
185 std::string DeviceCloudPolicyManagerChromeOS::GetMachineID() { | 105 std::string DeviceCloudPolicyManagerChromeOS::GetMachineID() { |
186 std::string machine_id; | 106 std::string machine_id; |
187 chromeos::system::StatisticsProvider* provider = | 107 chromeos::system::StatisticsProvider* provider = |
188 chromeos::system::StatisticsProvider::GetInstance(); | 108 chromeos::system::StatisticsProvider::GetInstance(); |
189 for (size_t i = 0; i < arraysize(kMachineInfoSerialNumberKeys); i++) { | 109 for (size_t i = 0; i < arraysize(kMachineInfoSerialNumberKeys); i++) { |
190 if (provider->GetMachineStatistic(kMachineInfoSerialNumberKeys[i], | 110 if (provider->GetMachineStatistic(kMachineInfoSerialNumberKeys[i], |
191 &machine_id) && | 111 &machine_id) && |
192 !machine_id.empty()) { | 112 !machine_id.empty()) { |
193 break; | 113 break; |
194 } | 114 } |
195 } | 115 } |
196 | 116 |
197 if (machine_id.empty()) | 117 if (machine_id.empty()) |
198 LOG(WARNING) << "Failed to get machine id."; | 118 LOG(WARNING) << "Failed to get machine id."; |
199 | 119 |
200 return machine_id; | 120 return machine_id; |
201 } | 121 } |
202 | 122 |
203 // static | 123 // static |
204 std::string DeviceCloudPolicyManagerChromeOS::GetMachineModel() { | 124 std::string DeviceCloudPolicyManagerChromeOS::GetMachineModel() { |
205 return GetMachineStatistic(chromeos::system::kHardwareClassKey); | 125 return GetMachineStatistic(chromeos::system::kHardwareClassKey); |
206 } | 126 } |
207 | 127 |
208 void DeviceCloudPolicyManagerChromeOS::StartConnection( | 128 void DeviceCloudPolicyManagerChromeOS::StartConnection( |
209 scoped_ptr<CloudPolicyClient> client_to_connect, | 129 scoped_ptr<CloudPolicyClient> client_to_connect, |
210 scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider) { | 130 scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider, |
| 131 PrefService* local_state) { |
211 CHECK(!service()); | 132 CHECK(!service()); |
212 | 133 |
213 device_status_provider_ = device_status_provider.Pass(); | 134 device_status_provider_ = device_status_provider.Pass(); |
214 | 135 |
215 // Set state keys here so the first policy fetch submits them to the server. | 136 // Set state keys here so the first policy fetch submits them to the server. |
216 if (ForcedReEnrollmentEnabled()) | 137 if (ForcedReEnrollmentEnabled()) |
217 client_to_connect->SetStateKeysToUpload(state_keys_broker_->state_keys()); | 138 client_to_connect->SetStateKeysToUpload(state_keys_broker_->state_keys()); |
218 | 139 |
219 core()->Connect(client_to_connect.Pass()); | 140 core()->Connect(client_to_connect.Pass()); |
220 core()->StartRefreshScheduler(); | 141 core()->StartRefreshScheduler(); |
221 core()->TrackRefreshDelayPref(local_state_, | 142 core()->TrackRefreshDelayPref(local_state, |
222 prefs::kDevicePolicyRefreshRate); | 143 prefs::kDevicePolicyRefreshRate); |
223 attestation_policy_observer_.reset( | 144 attestation_policy_observer_.reset( |
224 new chromeos::attestation::AttestationPolicyObserver(client())); | 145 new chromeos::attestation::AttestationPolicyObserver(client())); |
225 } | 146 } |
226 | 147 |
227 void DeviceCloudPolicyManagerChromeOS::OnStateKeysUpdated() { | 148 void DeviceCloudPolicyManagerChromeOS::OnStateKeysUpdated() { |
228 if (client() && ForcedReEnrollmentEnabled()) | 149 if (client() && ForcedReEnrollmentEnabled()) |
229 client()->SetStateKeysToUpload(state_keys_broker_->state_keys()); | 150 client()->SetStateKeysToUpload(state_keys_broker_->state_keys()); |
230 } | 151 } |
231 | 152 |
232 void DeviceCloudPolicyManagerChromeOS::InitializeRequisition() { | |
233 // OEM statistics are only loaded when OOBE is not completed. | |
234 if (chromeos::StartupUtils::IsOobeCompleted()) | |
235 return; | |
236 | |
237 const PrefService::Preference* pref = local_state_->FindPreference( | |
238 prefs::kDeviceEnrollmentRequisition); | |
239 if (pref->IsDefaultValue()) { | |
240 std::string requisition = | |
241 GetMachineStatistic(chromeos::system::kOemDeviceRequisitionKey); | |
242 | |
243 if (!requisition.empty()) { | |
244 local_state_->SetString(prefs::kDeviceEnrollmentRequisition, | |
245 requisition); | |
246 if (requisition == kRemoraRequisition || | |
247 requisition == kSharkRequisition) { | |
248 local_state_->SetBoolean(prefs::kDeviceEnrollmentAutoStart, true); | |
249 local_state_->SetBoolean(prefs::kDeviceEnrollmentCanExit, false); | |
250 } else { | |
251 local_state_->SetBoolean( | |
252 prefs::kDeviceEnrollmentAutoStart, | |
253 GetMachineFlag(chromeos::system::kOemIsEnterpriseManagedKey, | |
254 false)); | |
255 local_state_->SetBoolean( | |
256 prefs::kDeviceEnrollmentCanExit, | |
257 GetMachineFlag(chromeos::system::kOemCanExitEnterpriseEnrollmentKey, | |
258 false)); | |
259 } | |
260 } | |
261 } | |
262 } | |
263 | |
264 } // namespace policy | 153 } // namespace policy |
OLD | NEW |