The user's consent to crash dumps reporting can now be set via the UI (Windows only). The checkbox …

remoting/host/plugin/daemon_controller_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/plugin/daemon_controller.h"
 
 #include <objbase.h>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/string16.h"
 #include "base/stringize_macros.h"
 #include "base/threading/thread.h"
 #include "base/time.h"
 #include "base/timer.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "base/win/scoped_bstr.h"
 #include "base/win/scoped_comptr.h"
 #include "base/win/windows_version.h"
 #include "remoting/base/scoped_sc_handle_win.h"
 #include "remoting/host/branding.h"
+#include "remoting/host/breakpad.h"
 #include "remoting/host/plugin/daemon_installer_win.h"
 
 // MIDL-generated declarations and definitions.
 #include "remoting/host/elevated_controller.h"
 
 using base::win::ScopedBstr;
 using base::win::ScopedComPtr;
 
 namespace remoting {
 
@@ skipping 36 matching lines @@
   virtual State GetState() OVERRIDE;
   virtual void GetConfig(const GetConfigCallback& callback) OVERRIDE;
   virtual void SetConfigAndStart(
       scoped_ptr<base::DictionaryValue> config,
       const CompletionCallback& done_callback) OVERRIDE;
   virtual void UpdateConfig(scoped_ptr<base::DictionaryValue> config,
                             const CompletionCallback& done_callback) OVERRIDE;
   virtual void Stop(const CompletionCallback& done_callback) OVERRIDE;
   virtual void SetWindow(void* window_handle) OVERRIDE;
   virtual void GetVersion(const GetVersionCallback& done_callback) OVERRIDE;
+  virtual void GetUsageStatsConsent(
+      const GetUsageStatsConsentCallback& done_callback) OVERRIDE;
+  virtual void SetUsageStatsConsent(bool consent) OVERRIDE;
 
  private:
   // Activates an unprivileged instance of the daemon controller and caches it.
   HRESULT ActivateController();
 
   // Activates an elevated instance of the daemon controller and caches it.
   HRESULT ActivateElevatedController();
 
   // Releases the cached instance of the controller.
   void ReleaseController();
@@ skipping 22 matching lines @@
   void DoGetConfig(const GetConfigCallback& callback);
   void DoInstallAsNeededAndStart(scoped_ptr<base::DictionaryValue> config,
                                  const CompletionCallback& done_callback);
   void DoSetConfigAndStart(scoped_ptr<base::DictionaryValue> config,
                            const CompletionCallback& done_callback);
   void DoUpdateConfig(scoped_ptr<base::DictionaryValue> config,
                       const CompletionCallback& done_callback);
   void DoStop(const CompletionCallback& done_callback);
   void DoSetWindow(void* window_handle);
   void DoGetVersion(const GetVersionCallback& callback);
+  void DoGetUsageStatsConsent(
+      const GetUsageStatsConsentCallback& callback);
+  void DoSetUsageStatsConsent(bool consent);
 
-  // |control_| holds a reference to an instance of the daemon controller
-  // to prevent a UAC prompt on every operation.
+  // |control_| and |control2_| hold references to an instance of the daemon
+  // controller to prevent a UAC prompt on every operation.
   ScopedComPtr<IDaemonControl> control_;
+  ScopedComPtr<IDaemonControl2> control2_;
 
   // True if |control_| holds a reference to an elevated instance of the daemon
   // controller.
   bool control_is_elevated_;
 
   // This timer is used to release |control_| after a timeout.
   scoped_ptr<base::OneShotTimer<DaemonControllerWin> > release_timer_;
 
   // Handle of the plugin window.
   HWND window_handle_;
@@ skipping 109 matching lines @@
           window_handle));
 }
 
 void DaemonControllerWin::GetVersion(const GetVersionCallback& callback) {
   worker_thread_.message_loop_proxy()->PostTask(
       FROM_HERE,
       base::Bind(&DaemonControllerWin::DoGetVersion,
                  base::Unretained(this), callback));
 }
 
+void DaemonControllerWin::GetUsageStatsConsent(
+    const GetUsageStatsConsentCallback& callback) {
+  worker_thread_.message_loop_proxy()->PostTask(
+      FROM_HERE,
+      base::Bind(&DaemonControllerWin::DoGetUsageStatsConsent,
+                 base::Unretained(this), callback));
+}
+
+void DaemonControllerWin::SetUsageStatsConsent(bool consent) {
+  worker_thread_.message_loop_proxy()->PostTask(
+      FROM_HERE,
+      base::Bind(&DaemonControllerWin::DoSetUsageStatsConsent,
+                 base::Unretained(this), consent));
+}
+
 HRESULT DaemonControllerWin::ActivateController() {
   DCHECK(worker_thread_.message_loop_proxy()->BelongsToCurrentThread());
 
   if (control_.get() == NULL) {
     CLSID class_id;
     HRESULT hr = CLSIDFromProgID(kDaemonController, &class_id);
     if (FAILED(hr)) {
       return hr;
     }
 
     hr = CoCreateInstance(class_id, NULL, CLSCTX_LOCAL_SERVER,
                           IID_IDaemonControl, control_.ReceiveVoid());
     if (FAILED(hr)) {
       return hr;
     }
+
+    // Ignore the error. IID_IDaemonControl2 is optional.
+    control_.QueryInterface(IID_IDaemonControl2, control2_.ReceiveVoid());
   }
 
   return S_OK;
 }
 
 HRESULT DaemonControllerWin::ActivateElevatedController() {
   DCHECK(worker_thread_.message_loop_proxy()->BelongsToCurrentThread());
 
   // Release an unprivileged instance of the daemon controller if any.
   if (!control_is_elevated_) {
     ReleaseController();
   }
 
   if (control_.get() == NULL) {
     BIND_OPTS3 bind_options;
     memset(&bind_options, 0, sizeof(bind_options));
     bind_options.cbStruct = sizeof(bind_options);
     bind_options.hwnd = GetTopLevelWindow(window_handle_);
     bind_options.dwClassContext  = CLSCTX_LOCAL_SERVER;
 
     HRESULT hr = ::CoGetObject(
         kDaemonControllerElevationMoniker,
         &bind_options,
         IID_IDaemonControl,
         control_.ReceiveVoid());
     if (FAILED(hr)) {
       return hr;
     }
 
+    // Ignore the error. IID_IDaemonControl2 is optional.
+    control_.QueryInterface(IID_IDaemonControl2, control2_.ReceiveVoid());

[Jamie, 2012/06/14 23:43:56]

Does this result in an elevated IDaemonControl2 instance? That seems bad if
we're saying that changing this setting should not require admin.

[alexeypa (please no reviews), 2012/06/19 23:27:29]

Yes, but the UAC prompt has been shown to the user. So it is legit. :-)
The way the code work is:

- The COM controller will run under identity of the caller unless elevation
happened.
- The UAC prompt is shown if elevation is requested. If the user agreed to if we
can do admin tasks until the timeout expires. Currently 15 minutes.
- Omaha sets permissions on ClientStateMeduim key where we store the flag so
that interactive users can change values. It means that any user can enable and
disable crash reporting. It is assumed that it is safe enough.

[Jamie, 2012/06/21 18:47:52]

My point is that if the code is designed to be runnable as non-admin, then we
should never run it as admin. Can the code be rewritten to ensure this?

[alexeypa (please no reviews), 2012/06/21 23:30:25]

The code was designed to be running as either non-admin or admin. non-admin
clients will have less functionality available because they will not be able to
do certain operations. It is all controlled by the ACLs at the end. The calling
code should not make decisions whether an operation will succeed or fail
depending on the its identity.

+
     // Note that we hold a reference to an elevated instance now.
     control_is_elevated_ = true;
 
     // Release |control_| upon expiration of the timeout.
     release_timer_.reset(new base::OneShotTimer<DaemonControllerWin>());
     release_timer_->Start(FROM_HERE,
                           base::TimeDelta::FromSeconds(kUacTimeoutSec),
                           this,
                           &DaemonControllerWin::ReleaseController);
   }
 
   return S_OK;
 }
 
 void DaemonControllerWin::ReleaseController() {
   DCHECK(worker_thread_.message_loop_proxy()->BelongsToCurrentThread());
 
   control_.Release();
+  control2_.Release();
   release_timer_.reset();
   control_is_elevated_ = false;
 }
 
 void DaemonControllerWin::OnInstallationComplete(
     scoped_ptr<base::DictionaryValue> config,
     const CompletionCallback& done_callback,
     HRESULT result) {
   DCHECK(worker_thread_.message_loop_proxy()->BelongsToCurrentThread());
 
@@ skipping 252 matching lines @@
   hr = control_->GetVersion(version.Receive());
   if (FAILED(hr)) {
     callback.Run(version_null);
     return;
   }
 
   callback.Run(UTF16ToUTF8(
       string16(static_cast<BSTR>(version), version.Length())));
 }
 
+void DaemonControllerWin::DoGetUsageStatsConsent(
+    const GetUsageStatsConsentCallback& callback) {
+  DCHECK(worker_thread_.message_loop_proxy()->BelongsToCurrentThread());
+
+  // Activate the Daemon Controller and see if it supports |IDaemonControl2|.
+  HRESULT hr = ActivateController();
+  if (FAILED(hr) || control2_.get() == NULL) {
+    callback.Run(false, false);

[Jamie, 2012/06/14 23:43:56]

There should be a mechanism for reporting "not implemented" and we should use it
here.

[alexeypa (please no reviews), 2012/06/19 23:27:29]

Done.

+    return;
+  }
+
+  // Get the recorded user's consent.
+  BOOL set_by_policy;
+  BOOL allowed;
+  hr = control2_->GetUsageStatsConsent(&set_by_policy, &allowed);
+  if (FAILED(hr)) {
+    callback.Run(false, false);
+    return;
+  }
+
+  callback.Run(!!set_by_policy, !!allowed);
+}
+
+void DaemonControllerWin::DoSetUsageStatsConsent(bool consent) {
+  DCHECK(worker_thread_.message_loop_proxy()->BelongsToCurrentThread());
+
+  // Activate the Daemon Controller and see if it supports |IDaemonControl2|.
+  HRESULT hr = ActivateController();
+  if (FAILED(hr) || control2_.get() == NULL) {
+    return;

[Jamie, 2012/06/14 23:43:56]

It would be better to report failure to the caller, and propagate it to the
web-app, even if we just log an error for now.

[alexeypa (please no reviews), 2012/06/19 23:27:29]

Done.

+  }
+
+  // Record the user's consent.
+  hr = control2_->SetUsageStatsConsent(consent);
+  if (FAILED(hr)) {
+    return;
+  }
+}
+
 }  // namespace
 
 scoped_ptr<DaemonController> remoting::DaemonController::Create() {
   return scoped_ptr<DaemonController>(new DaemonControllerWin());
 }
 
 }  // namespace remoting