Access to Chrome via the System Tray should go through the User Manager.

chrome/browser/background/background_mode_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
 #include "base/base_paths.h"
 #include "base/bind.h"
@@ skipping 10 matching lines @@
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_info_cache.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/status_icons/status_icon.h"
 #include "chrome/browser/status_icons/status_tray.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
+#include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/ui/host_desktop.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/grit/chromium_strings.h"
@@ skipping 435 matching lines @@
       GetBackgroundModeIterator(old_profile_name);
   // We check that the returned iterator is valid due to unittests, but really
   // this should only be called on profiles already known by the background
   // mode manager.
   if (it != background_mode_data_.end()) {
     it->second->SetName(new_profile_name);
     UpdateStatusTrayIconContextMenu();
   }
 }
 
+BackgroundModeManager::BackgroundModeData*
+BackgroundModeManager::GetBackgroundModeDataForLastProfile() const {
+  Profile* most_recent_profile = g_browser_process->profile_manager()->
+      GetLastUsedProfileAllowedByPolicy();
+  BackgroundModeInfoMap::const_iterator profile_background_data =
+      background_mode_data_.find(most_recent_profile);
+
+  if (profile_background_data == background_mode_data_.end())
+    return NULL;
+
+  // Do not permit a locked profile to be used to open a browser.
+  ProfileInfoCache& cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  if (cache.ProfileIsSigninRequiredAtIndex(cache.GetIndexOfProfileWithPath(
+      profile_background_data->first->GetPath())))
+    return NULL;
+
+  return profile_background_data->second.get();
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 //  BackgroundModeManager::BackgroundModeData, StatusIconMenuModel overrides
 void BackgroundModeManager::ExecuteCommand(int command_id, int event_flags) {
-  // When a browser window is necessary, we use the first profile. The windows
-  // opened for these commands are not profile-specific, so any profile would
-  // work and the first is convenient.
-  BackgroundModeData* bmd = background_mode_data_.begin()->second.get();
+  BackgroundModeData* bmd = GetBackgroundModeDataForLastProfile();
   switch (command_id) {
     case IDC_ABOUT:
-      chrome::ShowAboutChrome(bmd->GetBrowserWindow());
+      if (bmd)
+        chrome::ShowAboutChrome(bmd->GetBrowserWindow());
+      else
+        chrome::ShowUserManagerThenAboutChrome();
       break;
     case IDC_TASK_MANAGER:
-      chrome::OpenTaskManager(bmd->GetBrowserWindow());
+      if (bmd)
+        chrome::OpenTaskManager(bmd->GetBrowserWindow());
+      else
+        chrome::ShowUserManagerThenTaskManager();
       break;
     case IDC_EXIT:
       content::RecordAction(UserMetricsAction("Exit"));
       chrome::CloseAllBrowsers();
       break;
     case IDC_STATUS_TRAY_KEEP_CHROME_RUNNING_IN_BACKGROUND: {
       // Background mode must already be enabled (as otherwise this menu would
       // not be visible).
       DCHECK(IsBackgroundModePrefEnabled());
       DCHECK(chrome::WillKeepAlive());
 
       // Set the background mode pref to "disabled" - the resulting notification
       // will result in a call to DisableBackgroundMode().
       PrefService* service = g_browser_process->local_state();
       DCHECK(service);
       service->SetBoolean(prefs::kBackgroundModeEnabled, false);
       break;
     }
     default:
       bmd->ExecuteCommand(command_id, event_flags);

[Andrew T Wilson (Slow), 2014/09/15 13:59:21]

What happens here (i.e. if you click on a background app while that profile is
locked)? Won't this crash because |bmd| is null?

[Mike Lerman, 2014/09/15 16:43:11]

It will! Excellent point, good sir.

       break;
   }
 }
 
 
 ///////////////////////////////////////////////////////////////////////////////
 //  BackgroundModeManager, private
 void BackgroundModeManager::DecrementKeepAliveCountForStartup() {
   if (keep_alive_for_startup_) {
     keep_alive_for_startup_ = false;
@@ skipping 271 matching lines @@
     }
   }
   return profile_it;
 }
 
 bool BackgroundModeManager::IsBackgroundModePrefEnabled() const {
   PrefService* service = g_browser_process->local_state();
   DCHECK(service);
   return service->GetBoolean(prefs::kBackgroundModeEnabled);
 }