Make curtain-mode controllable by policy.

remoting/host/remoting_me2me_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file implements a standalone host process for Me2Me.
 
 #include <string>
 
 #include "base/at_exit.h"
 #include "base/bind.h"
@@ skipping 32 matching lines @@
 #include "remoting/host/network_settings.h"
 #include "remoting/host/policy_hack/policy_watcher.h"
 #include "remoting/host/session_manager_factory.h"
 #include "remoting/host/signaling_connector.h"
 #include "remoting/host/usage_stats_consent.h"
 #include "remoting/host/video_frame_capturer.h"
 #include "remoting/jingle_glue/xmpp_signal_strategy.h"
 #include "remoting/protocol/me2me_host_authenticator_factory.h"
 
 #if defined(OS_MACOSX)
+#include "base/mac/scoped_cftyperef.h"
 #include "base/mac/scoped_nsautorelease_pool.h"
 #include "remoting/host/curtain_mode_mac.h"
 #include "remoting/host/sighup_listener_mac.h"
 #endif
 // N.B. OS_WIN is defined by including src/base headers.
 #if defined(OS_WIN)
 #include <commctrl.h>
 #endif
 #if defined(TOOLKIT_GTK)
 #include "ui/gfx/gtk_util.h"
@@ skipping 33 matching lines @@
   HostProcess()
       : message_loop_(MessageLoop::TYPE_UI),
 #ifdef OFFICIAL_BUILD
         oauth_use_official_client_id_(true),
 #else
         oauth_use_official_client_id_(false),
 #endif
         allow_nat_traversal_(true),
         restarting_(false),
         shutting_down_(false),
-        exit_code_(kSuccessExitCode) {
+        exit_code_(kSuccessExitCode)
+#if defined(OS_MACOSX)
+      , curtain_(base::Bind(&HostProcess::OnDisconnectRequested,
+                            base::Unretained(this)),
+                 base::Bind(&HostProcess::OnDisconnectRequested,
+                            base::Unretained(this)))
+#endif
+  {
     context_.reset(
         new ChromotingHostContext(message_loop_.message_loop_proxy()));
     context_->Start();
     network_change_notifier_.reset(net::NetworkChangeNotifier::Create());
     config_updated_timer_.reset(new base::DelayTimer<HostProcess>(
         FROM_HERE, base::TimeDelta::FromSeconds(2), this,
         &HostProcess::ConfigUpdatedDelayed));
   }
 
   bool InitWithCommandLine(const CommandLine* cmd_line) {
@@ skipping 195 matching lines @@
   }
 
   void OnPolicyUpdate(scoped_ptr<base::DictionaryValue> policies) {
     if (!context_->network_task_runner()->BelongsToCurrentThread()) {
       context_->network_task_runner()->PostTask(FROM_HERE, base::Bind(
           &HostProcess::OnPolicyUpdate, base::Unretained(this),
           base::Passed(&policies)));
       return;
     }
 
+    if (!host_) {
+      StartHost();
+    }
+
     bool bool_value;
     std::string string_value;
     if (policies->GetString(policy_hack::PolicyWatcher::kHostDomainPolicyName,
                             &string_value)) {
       OnHostDomainPolicyUpdate(string_value);
     }
     if (policies->GetBoolean(policy_hack::PolicyWatcher::kNatPolicyName,
                              &bool_value)) {
       OnNatPolicyUpdate(bool_value);
     }
+    if (policies->GetBoolean(
+            policy_hack::PolicyWatcher::kHostRequireCurtainPolicyName,
+            &bool_value)) {
+      OnCurtainPolicyUpdate(bool_value);
+    }
   }
 
   void OnHostDomainPolicyUpdate(const std::string& host_domain) {
     if (!context_->network_task_runner()->BelongsToCurrentThread()) {
       context_->network_task_runner()->PostTask(FROM_HERE, base::Bind(
           &HostProcess::OnHostDomainPolicyUpdate, base::Unretained(this),
           host_domain));
       return;
     }
 
     if (!host_domain.empty() &&
         !EndsWith(xmpp_login_, std::string("@") + host_domain, false)) {
       Shutdown(kInvalidHostDomainExitCode);
     }
   }
 
   void OnNatPolicyUpdate(bool nat_traversal_enabled) {
     if (!context_->network_task_runner()->BelongsToCurrentThread()) {
       context_->network_task_runner()->PostTask(FROM_HERE, base::Bind(
           &HostProcess::OnNatPolicyUpdate, base::Unretained(this),
           nat_traversal_enabled));
       return;
     }
 
     bool policy_changed = allow_nat_traversal_ != nat_traversal_enabled;
     allow_nat_traversal_ = nat_traversal_enabled;
 
-    if (host_) {
-      // Restart the host if the policy has changed while the host was
-      // online.
-      if (policy_changed)
-        RestartHost();
-    } else {
-      // Just start the host otherwise.
-      StartHost();
+    if (policy_changed) {
+      RestartHost();
     }
   }
 
+  void OnCurtainPolicyUpdate(bool curtain_required) {
+#if defined(OS_MACOSX)
+    if (!context_->network_task_runner()->BelongsToCurrentThread()) {
+      context_->network_task_runner()->PostTask(FROM_HERE, base::Bind(
+          &HostProcess::OnCurtainPolicyUpdate, base::Unretained(this),
+          curtain_required));
+      return;
+    }
+
+    if (curtain_required) {
+      // If curtain mode is required, then we can't currently support remoting
+      // the login screen. This is because we don't curtain the login screen
+      // and the current daemon architecture means that the connction is closed
+      // immediately after login, leaving the host system uncurtained.
+      //
+      // TODO(jamiewalch): Fix this once we have implemented the multi-process
+      // daemon architecture (crbug.com/134894)
+      base::mac::ScopedCFTypeRef<CFDictionaryRef> session(
+          CGSessionCopyCurrentDictionary());
+      const void* logged_in = CFDictionaryGetValue(session,
+                                                   kCGSessionLoginDoneKey);
+      if (logged_in != kCFBooleanTrue) {
+        Shutdown(kLoginScreenNotSupportedExitCode);
+        return;
+      }
+
+      host_->AddStatusObserver(&curtain_);
+      curtain_.SetEnabled(true);
+    } else {
+      curtain_.SetEnabled(false);
+      host_->RemoveStatusObserver(&curtain_);
+    }
+#endif
+  }
+
   void StartHost() {
     DCHECK(context_->network_task_runner()->BelongsToCurrentThread());
     DCHECK(!host_);
 
     if (shutting_down_)
       return;
 
     if (!signal_strategy_.get()) {
       signal_strategy_.reset(
           new XmppSignalStrategy(context_->url_request_context_getter(),
@@ skipping 60 matching lines @@
     log_to_server_.reset(
         new LogToServer(host_, ServerLogEntry::ME2ME, signal_strategy_.get()));
     host_event_logger_ = HostEventLogger::Create(host_, kApplicationName);
 
 #if defined(OS_MACOSX) || defined(OS_WIN)
     host_user_interface_->Start(
         host_, base::Bind(&HostProcess::OnDisconnectRequested,
                           base::Unretained(this)));
 #endif
 
-#if defined(OS_MACOSX)
-    curtain_.Init(base::Bind(&HostProcess::OnDisconnectRequested,
-                             base::Unretained(this)));
-    host_->AddStatusObserver(&curtain_);
-#endif
-
     host_->Start();
 
     CreateAuthenticatorFactory();
   }
 
   void OnAuthFailed() {
     Shutdown(kInvalidOauthCredentialsExitCode);
   }
 
   // Invoked when the user uses the Disconnect windows to terminate
@@ skipping 192 matching lines @@
             user32.GetFunctionPointer("SetProcessDPIAware"));
     set_process_dpi_aware();
   }
 
   // CommandLine::Init() ignores the passed |argc| and |argv| on Windows getting
   // the command line from GetCommandLineW(), so we can safely pass NULL here.
   return main(0, NULL);
 }
 
 #endif  // defined(OS_WIN)