Supervised users: Slightly relax restrictions around extensions.

chrome/browser/ui/webui/extensions/extension_settings_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/extensions/extension_settings_handler.h"
 
 #include "apps/app_load_service.h"
 #include "apps/saved_files_service.h"
 #include "base/auto_reset.h"
 #include "base/base64.h"
@@ skipping 258 matching lines @@
 
   bool recommended_install =
       !managed_install &&
       management_policy_->MustRemainInstalled(extension, NULL);
   extension_data->SetBoolean("recommendedInstall", recommended_install);
 
   // Suspicious install should always be mutually exclusive to managed and/or
   // recommended install.
   DCHECK(!(managed_install || recommended_install) || !suspicious_install);
 
+  // |web_ui()| can be null in unit tests.
+  bool installed_by_custodian =
+      web_ui() && Profile::FromWebUI(web_ui())->IsSupervised() &&
+      extension->was_installed_by_custodian();
+  extension_data->SetBoolean("installedByCustodian", installed_by_custodian);
+
   GURL icon =
       ExtensionIconSource::GetIconURL(extension,
                                       extension_misc::EXTENSION_ICON_MEDIUM,
                                       ExtensionIconSet::MATCH_BIGGER,
                                       !enabled, NULL);
   if (Manifest::IsUnpackedLocation(extension->location())) {
     extension_data->SetString("path", extension->path().value());
     extension_data->SetString(
         "prettifiedPath",
         extensions::path_util::PrettifyPath(extension->path()).value());
@@ skipping 785 matching lines @@
   CHECK_EQ(2U, args->GetSize());
   std::string extension_id, enable_str;
   CHECK(args->GetString(0, &extension_id));
   CHECK(args->GetString(1, &enable_str));
 
   const Extension* extension =
       extension_service_->GetInstalledExtension(extension_id);
   if (!extension)
     return;
 
+  if (Profile::FromWebUI(web_ui())->IsSupervised() &&
+      extension->was_installed_by_custodian()) {

[Pam (message me for reviews), 2015/02/23 10:18:50]

It really seems like being installed by a custodian should mean
UserMayModifySettings = false, which would simplify both these.

[Marc Treib, 2015/02/23 12:07:38]

As mentioned above: UserMayModifySettings = false really means "nothing may ever
change the enabled state of this extension, ever", which breaks our "update with
new permissions" flow.

[Pam (message me for reviews), 2015/02/23 12:20:17]

So that's something we should sort out fairly soon -- figure out whether it
really should be only user-initiated changes, and then either fix the semantics
or fix the name.  But not necessarily for this CL. For now, a comment on the
method in management_policy.h would be good.

[Marc Treib, 2015/02/23 12:33:59]

Done.

+    return;
+  }
+
   if (!management_policy_->UserMayModifySettings(extension, NULL)) {
     LOG(ERROR) << "An attempt was made to enable an extension that is "
                << "non-usermanagable. Extension id: " << extension->id();
     return;
   }
 
   if (enable_str == "true") {
     ExtensionPrefs* prefs = ExtensionPrefs::Get(extension_service_->profile());
     if (prefs->DidExtensionEscalatePermissions(extension_id)) {
       ShowExtensionDisabledDialog(
@@ skipping 64 matching lines @@
     const base::ListValue* args) {
   CHECK_EQ(2U, args->GetSize());
   std::string extension_id, allow_str;
   CHECK(args->GetString(0, &extension_id));
   CHECK(args->GetString(1, &allow_str));
   const Extension* extension =
       extension_service_->GetInstalledExtension(extension_id);
   if (!extension)
     return;
 
+  if (Profile::FromWebUI(web_ui())->IsSupervised() &&
+      extension->was_installed_by_custodian()) {
+    return;
+  }
+
   if (!management_policy_->UserMayModifySettings(extension, NULL)) {
     LOG(ERROR) << "An attempt was made to change allow file access of an"
                << " extension that is non-usermanagable. Extension id : "
                << extension->id();
     return;
   }
 
   util::SetAllowFileAccess(
       extension_id, extension_service_->profile(), allow_str == "true");
 }
@@ skipping 354 matching lines @@
     extension_service_->EnableExtension(extension_id);
   } else {
     ExtensionErrorReporter::GetInstance()->ReportError(
         base::UTF8ToUTF16(JoinString(requirement_errors, ' ')),
         true);  // Be noisy.
   }
   requirements_checker_.reset();
 }
 
 }  // namespace extensions