Add a group policy controlling which sites can install extensions.

chrome/app/policy/policy_templates.json

Index: chrome/app/policy/policy_templates.json
diff --git a/chrome/app/policy/policy_templates.json b/chrome/app/policy/policy_templates.json
index ad48e2d64123a9f6b00544cc0d2151bfbceb96b0..359491483d7fcc463fb54b8d2757736ca191788e 100644
--- a/chrome/app/policy/policy_templates.json
+++ b/chrome/app/policy/policy_templates.json
@@ -112,7 +112,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 147
+#   For your editing convenience: highest ID currently used: 148
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -1104,6 +1104,23 @@
           If this policy is left not set the user can uninstall any extension  in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.''',
           'label': '''Extension IDs and update URLs to be silently installed''',
         },
+        {
+          'name': 'ExtensionInstallSources',
+          'type': 'list',
+          'supported_on': ['chrome.*:21-', 'chrome_os:21-'],
+          'features': {'dynamic_refresh': True},
+          'example_value': ['https://corp.mycompany.com/*'],
+          'id': 148,
+          'caption': '''Configure extension, app, and user script install sources''',
+          'desc': '''Allows you to specify which URLs are allowed to install extensions, apps, and themes.
+
+          Starting in Chrome 21, it is more difficult to install extensions, apps, and user scripts from outside the Chrome Web Store. Previously, users could click on a link to a *.crx file, and Chrome would offer to install the file after a few warnings. After Chrome 21, such files must be downloaded an dragged onto the Chrome settings page. This setting allows specific URLs to have the old, easier installation flow.
+
+          Each item in this list is an extension-style match pattern (see http://code.google.com/chrome/extensions/match_patterns.html). Users will be able to easily install items from any URL that matches an item in this list.
+
+          ExtensionInstallBlacklist takes precedence over this policy. That is, an extension on the blacklist won't be installed, even if it happens from a site on this list.''',
+          'label': '''URL patterns to allow extension, app, and user script installs from''',
+        },
       ],
     },
     {