OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 #include <utility> | 8 #include <utility> |
9 | 9 |
10 #include "base/bind.h" | 10 #include "base/bind.h" |
11 #include "base/bind_helpers.h" | 11 #include "base/bind_helpers.h" |
12 #include "base/callback.h" | 12 #include "base/callback.h" |
13 #include "base/files/file_util.h" | 13 #include "base/files/file_util.h" |
14 #include "base/location.h" | 14 #include "base/location.h" |
15 #include "base/logging.h" | 15 #include "base/logging.h" |
16 #include "base/macros.h" | 16 #include "base/macros.h" |
17 #include "base/memory/ptr_util.h" | 17 #include "base/memory/ptr_util.h" |
18 #include "base/metrics/histogram_macros.h" | 18 #include "base/metrics/histogram_macros.h" |
19 #include "base/sequenced_task_runner.h" | 19 #include "base/sequenced_task_runner.h" |
20 #include "base/stl_util.h" | 20 #include "base/stl_util.h" |
21 #include "base/strings/stringprintf.h" | 21 #include "base/strings/stringprintf.h" |
| 22 #include "chrome/browser/lifetime/application_lifetime.h" |
22 #include "chromeos/cryptohome/cryptohome_parameters.h" | 23 #include "chromeos/cryptohome/cryptohome_parameters.h" |
23 #include "chromeos/dbus/cryptohome_client.h" | 24 #include "chromeos/dbus/cryptohome_client.h" |
24 #include "chromeos/dbus/session_manager_client.h" | |
25 #include "components/policy/core/common/cloud/cloud_policy_constants.h" | 25 #include "components/policy/core/common/cloud/cloud_policy_constants.h" |
26 #include "components/policy/proto/cloud_policy.pb.h" | 26 #include "components/policy/proto/cloud_policy.pb.h" |
27 #include "google_apis/gaia/gaia_auth_util.h" | 27 #include "google_apis/gaia/gaia_auth_util.h" |
28 | 28 |
29 namespace em = enterprise_management; | 29 namespace em = enterprise_management; |
30 | 30 |
31 namespace policy { | 31 namespace policy { |
32 | 32 |
33 namespace { | 33 namespace { |
34 | 34 |
(...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
101 | 101 |
102 void UserCloudPolicyStoreChromeOS::LoadImmediately() { | 102 void UserCloudPolicyStoreChromeOS::LoadImmediately() { |
103 // This blocking D-Bus call is in the startup path and will block the UI | 103 // This blocking D-Bus call is in the startup path and will block the UI |
104 // thread. This only happens when the Profile is created synchronously, which | 104 // thread. This only happens when the Profile is created synchronously, which |
105 // on Chrome OS happens whenever the browser is restarted into the same | 105 // on Chrome OS happens whenever the browser is restarted into the same |
106 // session. That happens when the browser crashes, or right after signin if | 106 // session. That happens when the browser crashes, or right after signin if |
107 // the user has flags configured in about:flags. | 107 // the user has flags configured in about:flags. |
108 // However, on those paths we must load policy synchronously so that the | 108 // However, on those paths we must load policy synchronously so that the |
109 // Profile initialization never sees unmanaged prefs, which would lead to | 109 // Profile initialization never sees unmanaged prefs, which would lead to |
110 // data loss. http://crbug.com/263061 | 110 // data loss. http://crbug.com/263061 |
111 std::string policy_blob = | 111 std::string policy_blob; |
| 112 RetrievePolicyResponseType response_type = |
112 session_manager_client_->BlockingRetrievePolicyForUser( | 113 session_manager_client_->BlockingRetrievePolicyForUser( |
113 cryptohome::Identification(account_id_)); | 114 cryptohome::Identification(account_id_), &policy_blob); |
| 115 |
| 116 if (response_type == RetrievePolicyResponseType::SESSION_DOES_NOT_EXIST) { |
| 117 LOG(ERROR) |
| 118 << "Session manager claims that session doesn't exist; signing out"; |
| 119 chrome::AttemptUserExit(); |
| 120 return; |
| 121 } |
| 122 |
114 if (policy_blob.empty()) { | 123 if (policy_blob.empty()) { |
115 // The session manager doesn't have policy, or the call failed. | 124 // The session manager doesn't have policy, or the call failed. |
116 NotifyStoreLoaded(); | 125 NotifyStoreLoaded(); |
117 return; | 126 return; |
118 } | 127 } |
119 | 128 |
120 std::unique_ptr<em::PolicyFetchResponse> policy( | 129 std::unique_ptr<em::PolicyFetchResponse> policy( |
121 new em::PolicyFetchResponse()); | 130 new em::PolicyFetchResponse()); |
122 if (!policy->ParseFromString(policy_blob)) { | 131 if (!policy->ParseFromString(policy_blob)) { |
123 status_ = STATUS_PARSE_ERROR; | 132 status_ = STATUS_PARSE_ERROR; |
(...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
206 } else { | 215 } else { |
207 // Load the policy right after storing it, to make sure it was accepted by | 216 // Load the policy right after storing it, to make sure it was accepted by |
208 // the session manager. An additional validation is performed after the | 217 // the session manager. An additional validation is performed after the |
209 // load; reload the key for that validation too, in case it was rotated. | 218 // load; reload the key for that validation too, in case it was rotated. |
210 ReloadPolicyKey(base::Bind(&UserCloudPolicyStoreChromeOS::Load, | 219 ReloadPolicyKey(base::Bind(&UserCloudPolicyStoreChromeOS::Load, |
211 weak_factory_.GetWeakPtr())); | 220 weak_factory_.GetWeakPtr())); |
212 } | 221 } |
213 } | 222 } |
214 | 223 |
215 void UserCloudPolicyStoreChromeOS::OnPolicyRetrieved( | 224 void UserCloudPolicyStoreChromeOS::OnPolicyRetrieved( |
216 const std::string& policy_blob) { | 225 const std::string& policy_blob, |
| 226 RetrievePolicyResponseType response_type) { |
| 227 // Disallow the sign in when the Chrome OS user session has not started, which |
| 228 // should always happen before the profile construction. An attempt to read |
| 229 // the policy outside the session will always fail and return an empty policy |
| 230 // blob. |
| 231 if (response_type == RetrievePolicyResponseType::SESSION_DOES_NOT_EXIST) { |
| 232 LOG(ERROR) |
| 233 << "Session manager claims that session doesn't exist; signing out"; |
| 234 chrome::AttemptUserExit(); |
| 235 return; |
| 236 } |
| 237 |
217 if (policy_blob.empty()) { | 238 if (policy_blob.empty()) { |
218 // session_manager doesn't have policy. Adjust internal state and notify | 239 // session_manager doesn't have policy. Adjust internal state and notify |
219 // the world about the policy update. | 240 // the world about the policy update. |
220 policy_map_.Clear(); | 241 policy_map_.Clear(); |
221 policy_.reset(); | 242 policy_.reset(); |
222 policy_signature_public_key_.clear(); | 243 policy_signature_public_key_.clear(); |
223 NotifyStoreLoaded(); | 244 NotifyStoreLoaded(); |
224 return; | 245 return; |
225 } | 246 } |
226 | 247 |
(...skipping 142 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
369 validator->ValidateUsername(account_id_.GetUserEmail(), true); | 390 validator->ValidateUsername(account_id_.GetUserEmail(), true); |
370 // The policy loaded from session manager need not be validated using the | 391 // The policy loaded from session manager need not be validated using the |
371 // verification key since it is secure, and since there may be legacy policy | 392 // verification key since it is secure, and since there may be legacy policy |
372 // data that was stored without a verification key. | 393 // data that was stored without a verification key. |
373 validator->ValidateSignature(cached_policy_key_); | 394 validator->ValidateSignature(cached_policy_key_); |
374 } | 395 } |
375 return validator; | 396 return validator; |
376 } | 397 } |
377 | 398 |
378 } // namespace policy | 399 } // namespace policy |
OLD | NEW |