1 // Copyright (c) 2012 The Chromium OS Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef LIBBRILLO_POLICY_DEVICE_POLICY_IMPL_H_ 6 #define LIBBRILLO_POLICY_DEVICE_POLICY_IMPL_H_ 7 8 #include <set> 9 #include <string> 10 #include <vector> 11 12 #include <base/files/file_path.h> 13 #include <base/macros.h> 14 15 #include "bindings/chrome_device_policy.pb.h" 16 #include "bindings/device_management_backend.pb.h" 17 #include "policy/device_policy.h" 18 19 #pragma GCC visibility push(default) 20 21 namespace policy { 22 23 // This class holds device settings that are to be enforced across all users. 24 // 25 // Before serving it to the users this class verifies that the policy is valid 26 // against its signature and the owner's key and also that the policy files 27 // are owned by root. 28 class DevicePolicyImpl : public DevicePolicy { 29 public: 30 DevicePolicyImpl(); 31 ~DevicePolicyImpl() override; 32 33 bool LoadPolicy() override; 34 bool GetPolicyRefreshRate(int* rate) const override; 35 bool GetUserWhitelist( 36 std::vector<std::string>* user_whitelist) const override; 37 bool GetGuestModeEnabled(bool* guest_mode_enabled) const override; 38 bool GetCameraEnabled(bool* camera_enabled) const override; 39 bool GetShowUserNames(bool* show_user_names) const override; 40 bool GetDataRoamingEnabled(bool* data_roaming_enabled) const override; 41 bool GetAllowNewUsers(bool* allow_new_users) const override; 42 bool GetMetricsEnabled(bool* metrics_enabled) const override; 43 bool GetReportVersionInfo(bool* report_version_info) const override; 44 bool GetReportActivityTimes(bool* report_activity_times) const override; 45 bool GetReportBootMode(bool* report_boot_mode) const override; 46 bool GetEphemeralUsersEnabled(bool* ephemeral_users_enabled) const override; 47 bool GetReleaseChannel(std::string* release_channel) const override; 48 bool GetReleaseChannelDelegated( 49 bool* release_channel_delegated) const override; 50 bool GetUpdateDisabled(bool* update_disabled) const override; 51 bool GetTargetVersionPrefix( 52 std::string* target_version_prefix) const override; 53 bool GetScatterFactorInSeconds( 54 int64_t* scatter_factor_in_seconds) const override; 55 bool GetAllowedConnectionTypesForUpdate( 56 std::set<std::string>* connection_types) const override; 57 bool GetOpenNetworkConfiguration( 58 std::string* open_network_configuration) const override; 59 bool GetOwner(std::string* owner) const override; 60 bool GetHttpDownloadsEnabled(bool* http_downloads_enabled) const override; 61 bool GetAuP2PEnabled(bool* au_p2p_enabled) const override; 62 bool GetAllowKioskAppControlChromeVersion( 63 bool* allow_kiosk_app_control_chrome_version) const override; 64 bool GetUsbDetachableWhitelist( 65 std::vector<UsbDeviceId>* usb_whitelist) const override; 66 bool GetAutoLaunchedKioskAppId(std::string* app_id_out) const override; 67 68 // Methods that can be used only for testing. 69 void set_policy_data_for_testing( 70 const enterprise_management::PolicyData& policy_data) { 71 policy_data_ = policy_data; 72 } 73 void set_verify_root_ownership_for_testing(bool verify_root_ownership) { 74 verify_root_ownership_ = verify_root_ownership; 75 } 76 void set_install_attributes_for_testing( 77 std::unique_ptr<InstallAttributesReader> install_attributes_reader) { 78 install_attributes_reader_ = std::move(install_attributes_reader); 79 } 80 void set_policy_path_for_testing(const base::FilePath& policy_path) { 81 policy_path_ = policy_path; 82 } 83 void set_key_file_path_for_testing(const base::FilePath& keyfile_path) { 84 keyfile_path_ = keyfile_path; 85 } 86 87 private: 88 // Verifies that both the policy file and the signature file exist and are 89 // owned by the root. Does nothing when |verify_root_ownership_| is set to 90 // false. 91 bool VerifyPolicyFile(const base::FilePath& policy_path); 92 93 // Verifies that the policy signature is correct. 94 bool VerifyPolicySignature() override; 95 96 // Loads the signed policy off of disk from |policy_path| into |policy_|. 97 // Returns true if the |policy_path| is present on disk and loading it is 98 // successful. 99 bool LoadPolicyFromFile(const base::FilePath& policy_path); 100 101 base::FilePath policy_path_; 102 base::FilePath keyfile_path_; 103 std::unique_ptr<InstallAttributesReader> install_attributes_reader_; 104 enterprise_management::PolicyFetchResponse policy_; 105 enterprise_management::PolicyData policy_data_; 106 enterprise_management::ChromeDeviceSettingsProto device_policy_; 107 108 // If true, verify that policy files are owned by root. True in production 109 // but can be set to false by tests. 110 bool verify_root_ownership_; 111 112 DISALLOW_COPY_AND_ASSIGN(DevicePolicyImpl); 113 }; 114 } // namespace policy 115 116 #pragma GCC visibility pop 117 118 #endif // LIBBRILLO_POLICY_DEVICE_POLICY_IMPL_H_ 119
