1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h" 6 7 #include <string> 8 #include "base/bind.h" 9 #include "base/bind_helpers.h" 10 #include "base/command_line.h" 11 #include "base/files/file_path.h" 12 #include "base/location.h" 13 #include "base/logging.h" 14 #include "base/message_loop/message_loop.h" 15 #include "base/message_loop/message_loop_proxy.h" 16 #include "base/path_service.h" 17 #include "base/prefs/pref_registry_simple.h" 18 #include "base/sequenced_task_runner.h" 19 #include "base/strings/utf_string_conversions.h" 20 #include "base/threading/sequenced_worker_pool.h" 21 #include "chrome/browser/chromeos/policy/app_pack_updater.h" 22 #include "chrome/browser/chromeos/policy/consumer_management_service.h" 23 #include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h" 24 #include "chrome/browser/chromeos/policy/device_cloud_policy_invalidator.h" 25 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h" 26 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h" 27 #include "chrome/browser/chromeos/policy/device_local_account.h" 28 #include "chrome/browser/chromeos/policy/device_local_account_policy_service.h" 29 #include "chrome/browser/chromeos/policy/device_network_configuration_updater.h" 30 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h" 31 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h" 32 #include "chrome/browser/chromeos/settings/cros_settings.h" 33 #include "chrome/browser/chromeos/settings/device_settings_service.h" 34 #include "chrome/browser/policy/device_management_service_configuration.h" 35 #include "chrome/common/pref_names.h" 36 #include "chromeos/chromeos_paths.h" 37 #include "chromeos/chromeos_switches.h" 38 #include "chromeos/cryptohome/system_salt_getter.h" 39 #include "chromeos/dbus/cryptohome_client.h" 40 #include "chromeos/dbus/dbus_thread_manager.h" 41 #include "chromeos/network/network_handler.h" 42 #include "chromeos/network/onc/onc_certificate_importer_impl.h" 43 #include "chromeos/settings/cros_settings_names.h" 44 #include "chromeos/settings/cros_settings_provider.h" 45 #include "chromeos/settings/timezone_settings.h" 46 #include "components/policy/core/common/cloud/cloud_policy_client.h" 47 #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h" 48 #include "components/policy/core/common/proxy_policy_provider.h" 49 #include "content/public/browser/browser_thread.h" 50 #include "google_apis/gaia/gaia_auth_util.h" 51 #include "net/url_request/url_request_context_getter.h" 52 53 using content::BrowserThread; 54 55 namespace policy { 56 57 namespace { 58 59 // TODO(davidyu): Update the URL to the real one once it is ready. 60 // http://crbug.com/366491. 61 // 62 // The URL for the consumer device management server. 63 const char kDefaultConsumerDeviceManagementServerUrl[] = 64 "https://m.google.com/devicemanagement/data/api"; 65 66 // Install attributes for tests. 67 EnterpriseInstallAttributes* g_testing_install_attributes = NULL; 68 69 // Helper that returns a new SequencedTaskRunner backed by the blocking pool. 70 // Each SequencedTaskRunner returned is independent from the others. 71 scoped_refptr<base::SequencedTaskRunner> GetBackgroundTaskRunner() { 72 base::SequencedWorkerPool* pool = BrowserThread::GetBlockingPool(); 73 CHECK(pool); 74 return pool->GetSequencedTaskRunnerWithShutdownBehavior( 75 pool->GetSequenceToken(), base::SequencedWorkerPool::SKIP_ON_SHUTDOWN); 76 } 77 78 std::string GetDeviceManagementServerUrlForConsumer() { 79 const CommandLine* command_line = CommandLine::ForCurrentProcess(); 80 if (command_line->HasSwitch( 81 chromeos::switches::kConsumerDeviceManagementUrl)) { 82 return command_line->GetSwitchValueASCII( 83 chromeos::switches::kConsumerDeviceManagementUrl); 84 } 85 return kDefaultConsumerDeviceManagementServerUrl; 86 } 87 88 } // namespace 89 90 BrowserPolicyConnectorChromeOS::BrowserPolicyConnectorChromeOS() 91 : device_cloud_policy_manager_(NULL), 92 global_user_cloud_policy_provider_(NULL), 93 weak_ptr_factory_(this) { 94 if (g_testing_install_attributes) { 95 install_attributes_.reset(g_testing_install_attributes); 96 g_testing_install_attributes = NULL; 97 } 98 99 // SystemSaltGetter or DBusThreadManager may be uninitialized on unit tests. 100 101 // TODO(satorux): Remove SystemSaltGetter::IsInitialized() when it's ready 102 // (removing it now breaks tests). crbug.com/141016. 103 if (chromeos::SystemSaltGetter::IsInitialized() && 104 chromeos::DBusThreadManager::IsInitialized()) { 105 state_keys_broker_.reset(new ServerBackedStateKeysBroker( 106 chromeos::DBusThreadManager::Get()->GetSessionManagerClient(), 107 base::MessageLoopProxy::current())); 108 109 chromeos::CryptohomeClient* cryptohome_client = 110 chromeos::DBusThreadManager::Get()->GetCryptohomeClient(); 111 if (!install_attributes_) { 112 install_attributes_.reset( 113 new EnterpriseInstallAttributes(cryptohome_client)); 114 } 115 base::FilePath install_attrs_file; 116 CHECK(PathService::Get(chromeos::FILE_INSTALL_ATTRIBUTES, 117 &install_attrs_file)); 118 install_attributes_->ReadCacheFile(install_attrs_file); 119 120 scoped_ptr<DeviceCloudPolicyStoreChromeOS> device_cloud_policy_store( 121 new DeviceCloudPolicyStoreChromeOS( 122 chromeos::DeviceSettingsService::Get(), 123 install_attributes_.get(), 124 GetBackgroundTaskRunner())); 125 device_cloud_policy_manager_ = 126 new DeviceCloudPolicyManagerChromeOS(device_cloud_policy_store.Pass(), 127 base::MessageLoopProxy::current(), 128 state_keys_broker_.get()); 129 AddPolicyProvider( 130 scoped_ptr<ConfigurationPolicyProvider>(device_cloud_policy_manager_)); 131 } 132 133 global_user_cloud_policy_provider_ = new ProxyPolicyProvider(); 134 AddPolicyProvider(scoped_ptr<ConfigurationPolicyProvider>( 135 global_user_cloud_policy_provider_)); 136 } 137 138 BrowserPolicyConnectorChromeOS::~BrowserPolicyConnectorChromeOS() {} 139 140 void BrowserPolicyConnectorChromeOS::Init( 141 PrefService* local_state, 142 scoped_refptr<net::URLRequestContextGetter> request_context) { 143 ChromeBrowserPolicyConnector::Init(local_state, request_context); 144 145 scoped_ptr<DeviceManagementService::Configuration> configuration( 146 new DeviceManagementServiceConfiguration( 147 GetDeviceManagementServerUrlForConsumer())); 148 consumer_device_management_service_.reset( 149 new DeviceManagementService(configuration.Pass())); 150 consumer_device_management_service_->ScheduleInitialization( 151 kServiceInitializationStartupDelay); 152 153 const CommandLine* command_line = CommandLine::ForCurrentProcess(); 154 if (command_line->HasSwitch(chromeos::switches::kEnableConsumerManagement)) { 155 chromeos::CryptohomeClient* cryptohome_client = 156 chromeos::DBusThreadManager::Get()->GetCryptohomeClient(); 157 consumer_management_service_.reset( 158 new ConsumerManagementService(cryptohome_client, 159 chromeos::DeviceSettingsService::Get())); 160 } 161 162 if (device_cloud_policy_manager_) { 163 // Note: for now the |device_cloud_policy_manager_| is using the global 164 // schema registry. Eventually it will have its own registry, once device 165 // cloud policy for extensions is introduced. That means it'd have to be 166 // initialized from here instead of BrowserPolicyConnector::Init(). 167 168 device_cloud_policy_manager_->Initialize(local_state); 169 170 device_cloud_policy_initializer_.reset( 171 new DeviceCloudPolicyInitializer( 172 local_state, 173 device_management_service(), 174 GetDeviceManagementServiceForConsumer(), 175 GetBackgroundTaskRunner(), 176 install_attributes_.get(), 177 state_keys_broker_.get(), 178 device_cloud_policy_manager_->device_store(), 179 device_cloud_policy_manager_, 180 chromeos::DeviceSettingsService::Get(), 181 base::Bind(&BrowserPolicyConnectorChromeOS:: 182 OnDeviceCloudPolicyManagerConnected, 183 base::Unretained(this)))); 184 device_cloud_policy_initializer_->Init(); 185 } 186 187 device_local_account_policy_service_.reset( 188 new DeviceLocalAccountPolicyService( 189 chromeos::DBusThreadManager::Get()->GetSessionManagerClient(), 190 chromeos::DeviceSettingsService::Get(), 191 chromeos::CrosSettings::Get(), 192 GetBackgroundTaskRunner(), 193 GetBackgroundTaskRunner(), 194 GetBackgroundTaskRunner(), 195 content::BrowserThread::GetMessageLoopProxyForThread( 196 content::BrowserThread::IO), 197 request_context)); 198 device_local_account_policy_service_->Connect(device_management_service()); 199 device_cloud_policy_invalidator_.reset(new DeviceCloudPolicyInvalidator); 200 201 // request_context is NULL in unit tests. 202 if (request_context.get() && install_attributes_) { 203 app_pack_updater_.reset( 204 new AppPackUpdater(request_context.get(), install_attributes_.get())); 205 } 206 207 SetTimezoneIfPolicyAvailable(); 208 209 network_configuration_updater_ = 210 DeviceNetworkConfigurationUpdater::CreateForDevicePolicy( 211 GetPolicyService(), 212 chromeos::NetworkHandler::Get() 213 ->managed_network_configuration_handler(), 214 chromeos::NetworkHandler::Get()->network_device_handler(), 215 chromeos::CrosSettings::Get()); 216 } 217 218 void BrowserPolicyConnectorChromeOS::PreShutdown() { 219 // Let the |device_cloud_policy_invalidator_| unregister itself as an 220 // observer of per-Profile InvalidationServices and the device-global 221 // invalidation::TiclInvalidationService it may have created as an observer of 222 // the DeviceOAuth2TokenService that is destroyed before Shutdown() is called. 223 device_cloud_policy_invalidator_.reset(); 224 225 // The |consumer_management_service_| may be observing a 226 // ProfileOAuth2TokenService and needs to be destroyed before the token 227 // service. 228 consumer_management_service_.reset(); 229 } 230 231 void BrowserPolicyConnectorChromeOS::Shutdown() { 232 // Verify that PreShutdown() has been called first. 233 DCHECK(!device_cloud_policy_invalidator_); 234 DCHECK(!consumer_management_service_); 235 236 // The AppPackUpdater may be observing the |device_cloud_policy_manager_|. 237 // Delete it first. 238 app_pack_updater_.reset(); 239 240 network_configuration_updater_.reset(); 241 242 if (device_local_account_policy_service_) 243 device_local_account_policy_service_->Shutdown(); 244 245 if (device_cloud_policy_initializer_) 246 device_cloud_policy_initializer_->Shutdown(); 247 248 ChromeBrowserPolicyConnector::Shutdown(); 249 } 250 251 bool BrowserPolicyConnectorChromeOS::IsEnterpriseManaged() { 252 return install_attributes_ && install_attributes_->IsEnterpriseDevice(); 253 } 254 255 std::string BrowserPolicyConnectorChromeOS::GetEnterpriseDomain() { 256 return install_attributes_ ? install_attributes_->GetDomain() : std::string(); 257 } 258 259 DeviceMode BrowserPolicyConnectorChromeOS::GetDeviceMode() { 260 return install_attributes_ ? install_attributes_->GetMode() 261 : DEVICE_MODE_NOT_SET; 262 } 263 264 UserAffiliation BrowserPolicyConnectorChromeOS::GetUserAffiliation( 265 const std::string& user_name) { 266 // An empty username means incognito user in case of ChromiumOS and 267 // no logged-in user in case of Chromium (SigninService). Many tests use 268 // nonsense email addresses (e.g. 'test') so treat those as non-enterprise 269 // users. 270 if (user_name.empty() || user_name.find('@') == std::string::npos) 271 return USER_AFFILIATION_NONE; 272 273 if (install_attributes_ && 274 (gaia::ExtractDomainName(gaia::CanonicalizeEmail(user_name)) == 275 install_attributes_->GetDomain() || 276 policy::IsDeviceLocalAccountUser(user_name, NULL))) { 277 return USER_AFFILIATION_MANAGED; 278 } 279 280 return USER_AFFILIATION_NONE; 281 } 282 283 AppPackUpdater* BrowserPolicyConnectorChromeOS::GetAppPackUpdater() { 284 return app_pack_updater_.get(); 285 } 286 287 void BrowserPolicyConnectorChromeOS::SetUserPolicyDelegate( 288 ConfigurationPolicyProvider* user_policy_provider) { 289 global_user_cloud_policy_provider_->SetDelegate(user_policy_provider); 290 } 291 292 void BrowserPolicyConnectorChromeOS::SetDeviceCloudPolicyInitializerForTesting( 293 scoped_ptr<DeviceCloudPolicyInitializer> initializer) { 294 device_cloud_policy_initializer_ = initializer.Pass(); 295 } 296 297 void BrowserPolicyConnectorChromeOS::SetInstallAttributesForTesting( 298 EnterpriseInstallAttributes* attributes) { 299 DCHECK(!g_testing_install_attributes); 300 g_testing_install_attributes = attributes; 301 } 302 303 void BrowserPolicyConnectorChromeOS::RemoveInstallAttributesForTesting() { 304 if (g_testing_install_attributes) { 305 delete g_testing_install_attributes; 306 g_testing_install_attributes = NULL; 307 } 308 } 309 310 // static 311 void BrowserPolicyConnectorChromeOS::RegisterPrefs( 312 PrefRegistrySimple* registry) { 313 registry->RegisterIntegerPref( 314 prefs::kDevicePolicyRefreshRate, 315 CloudPolicyRefreshScheduler::kDefaultRefreshDelayMs); 316 } 317 318 void BrowserPolicyConnectorChromeOS::SetTimezoneIfPolicyAvailable() { 319 typedef chromeos::CrosSettingsProvider Provider; 320 Provider::TrustedStatus result = 321 chromeos::CrosSettings::Get()->PrepareTrustedValues(base::Bind( 322 &BrowserPolicyConnectorChromeOS::SetTimezoneIfPolicyAvailable, 323 weak_ptr_factory_.GetWeakPtr())); 324 325 if (result != Provider::TRUSTED) 326 return; 327 328 std::string timezone; 329 if (chromeos::CrosSettings::Get()->GetString(chromeos::kSystemTimezonePolicy, 330 &timezone) && 331 !timezone.empty()) { 332 chromeos::system::TimezoneSettings::GetInstance()->SetTimezoneFromID( 333 base::UTF8ToUTF16(timezone)); 334 } 335 } 336 337 void BrowserPolicyConnectorChromeOS::OnDeviceCloudPolicyManagerConnected() { 338 // This function is invoked by DCPInitializer, so we should release the 339 // initializer after this function returns. 340 if (device_cloud_policy_initializer_) { 341 device_cloud_policy_initializer_->Shutdown(); 342 base::MessageLoop::current()->DeleteSoon( 343 FROM_HERE, device_cloud_policy_initializer_.release()); 344 } 345 } 346 347 } // namespace policy 348