chrome/browser/chromeos/policy/device_local_account_policy_service.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_
   6 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_
   7
   8 #include <map>
   9 #include <set>
  10 #include <string>
  11
  12 #include "base/basictypes.h"
  13 #include "base/callback.h"
  14 #include "base/compiler_specific.h"
  15 #include "base/files/file_path.h"
  16 #include "base/memory/ref_counted.h"
  17 #include "base/memory/scoped_ptr.h"
  18 #include "base/memory/weak_ptr.h"
  19 #include "base/observer_list.h"
  20 #include "chrome/browser/chromeos/extensions/device_local_account_external_policy_loader.h"
  21 #include "chrome/browser/chromeos/policy/device_local_account_extension_tracker.h"
  22 #include "chrome/browser/chromeos/policy/device_local_account_external_data_manager.h"
  23 #include "chrome/browser/chromeos/settings/cros_settings.h"
  24 #include "components/policy/core/common/cloud/cloud_policy_core.h"
  25 #include "components/policy/core/common/cloud/cloud_policy_store.h"
  26 #include "components/policy/core/common/cloud/component_cloud_policy_service.h"
  27 #include "components/policy/core/common/schema_registry.h"
  28
  29 namespace base {
  30 class SequencedTaskRunner;
  31 }
  32
  33 namespace chromeos {
  34 class DeviceSettingsService;
  35 class SessionManagerClient;
  36 }
  37
  38 namespace net {
  39 class URLRequestContextGetter;
  40 }
  41
  42 namespace policy {
  43
  44 class AffiliatedCloudPolicyInvalidator;
  45 class AffiliatedInvalidationServiceProvider;
  46 struct DeviceLocalAccount;
  47 class DeviceLocalAccountExternalDataService;
  48 class DeviceLocalAccountPolicyStore;
  49 class DeviceManagementService;
  50
  51 // The main switching central that downloads, caches, refreshes, etc. policy for
  52 // a single device-local account.
  53 class DeviceLocalAccountPolicyBroker
  54     : public CloudPolicyStore::Observer,
  55       public ComponentCloudPolicyService::Delegate {
  56  public:
  57   // |invalidation_service_provider| must outlive |this|.
  58   // |policy_update_callback| will be invoked to notify observers that the
  59   // policy for |account| has been updated.
  60   // |task_runner| is the runner for policy refresh tasks.
  61   DeviceLocalAccountPolicyBroker(
  62       const DeviceLocalAccount& account,
  63       const base::FilePath& component_policy_cache_path,
  64       scoped_ptr<DeviceLocalAccountPolicyStore> store,
  65       scoped_refptr<DeviceLocalAccountExternalDataManager>
  66           external_data_manager,
  67       const base::Closure& policy_updated_callback,
  68       const scoped_refptr<base::SequencedTaskRunner>& task_runner,
  69       AffiliatedInvalidationServiceProvider* invalidation_service_provider);
  70   ~DeviceLocalAccountPolicyBroker() override;
  71
  72   // Initialize the broker, loading its |store_|.
  73   void Initialize();
  74
  75   // For the difference between |account_id| and |user_id|, see the
  76   // documentation of DeviceLocalAccount.
  77   const std::string& account_id() const { return account_id_; }
  78   const std::string& user_id() const { return user_id_; }
  79
  80   scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader>
  81       extension_loader() const { return extension_loader_; }
  82
  83   CloudPolicyCore* core() { return &core_; }
  84   const CloudPolicyCore* core() const { return &core_; }
  85
  86   scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager() {
  87     return external_data_manager_;
  88   }
  89
  90   ComponentCloudPolicyService* component_policy_service() const {
  91     return component_policy_service_.get();
  92   }
  93
  94   SchemaRegistry* schema_registry() { return &schema_registry_; }
  95
  96   bool HasInvalidatorForTest() const;
  97
  98   // Fire up the cloud connection for fetching policy for the account from the
  99   // cloud if this is an enterprise-managed device.
 100   void ConnectIfPossible(
 101       chromeos::DeviceSettingsService* device_settings_service,
 102       DeviceManagementService* device_management_service,
 103       scoped_refptr<net::URLRequestContextGetter> request_context);
 104
 105   // Reads the refresh delay from policy and configures the refresh scheduler.
 106   void UpdateRefreshDelay();
 107
 108   // Retrieves the display name for the account as stored in policy. Returns an
 109   // empty string if the policy is not present.
 110   std::string GetDisplayName() const;
 111
 112   // CloudPolicyStore::Observer:
 113   void OnStoreLoaded(CloudPolicyStore* store) override;
 114   void OnStoreError(CloudPolicyStore* store) override;
 115
 116   // ComponentCloudPolicyService::Delegate:
 117   void OnComponentCloudPolicyUpdated() override;
 118
 119  private:
 120   void CreateComponentCloudPolicyService(
 121       const scoped_refptr<net::URLRequestContextGetter>& request_context,
 122       CloudPolicyClient* client);
 123
 124   AffiliatedInvalidationServiceProvider* const invalidation_service_provider_;
 125   const std::string account_id_;
 126   const std::string user_id_;
 127   const base::FilePath component_policy_cache_path_;
 128   SchemaRegistry schema_registry_;
 129   const scoped_ptr<DeviceLocalAccountPolicyStore> store_;
 130   DeviceLocalAccountExtensionTracker extension_tracker_;
 131   scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager_;
 132   scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader>
 133       extension_loader_;
 134   CloudPolicyCore core_;
 135   scoped_ptr<ComponentCloudPolicyService> component_policy_service_;
 136   base::Closure policy_update_callback_;
 137   scoped_ptr<AffiliatedCloudPolicyInvalidator> invalidator_;
 138
 139   DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyBroker);
 140 };
 141
 142 // Manages user policy blobs for device-local accounts present on the device.
 143 // The actual policy blobs are brokered by session_manager (to prevent file
 144 // manipulation), and we're making signature checks on the policy blobs to
 145 // ensure they're issued by the device owner.
 146 class DeviceLocalAccountPolicyService {
 147  public:
 148   // Interface for interested parties to observe policy changes.
 149   class Observer {
 150    public:
 151     virtual ~Observer() {}
 152
 153     // Policy for the given |user_id| has changed.
 154     virtual void OnPolicyUpdated(const std::string& user_id) = 0;
 155
 156     // The list of accounts has been updated.
 157     virtual void OnDeviceLocalAccountsChanged() = 0;
 158   };
 159
 160   DeviceLocalAccountPolicyService(
 161       chromeos::SessionManagerClient* session_manager_client,
 162       chromeos::DeviceSettingsService* device_settings_service,
 163       chromeos::CrosSettings* cros_settings,
 164       AffiliatedInvalidationServiceProvider* invalidation_service_provider,
 165       scoped_refptr<base::SequencedTaskRunner> store_background_task_runner,
 166       scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner,
 167       scoped_refptr<base::SequencedTaskRunner>
 168           external_data_service_backend_task_runner,
 169       scoped_refptr<base::SequencedTaskRunner> io_task_runner,
 170       scoped_refptr<net::URLRequestContextGetter> request_context);
 171   virtual ~DeviceLocalAccountPolicyService();
 172
 173   // Shuts down the service and prevents further policy fetches from the cloud.
 174   void Shutdown();
 175
 176   // Initializes the cloud policy service connection.
 177   void Connect(DeviceManagementService* device_management_service);
 178
 179   // Get the policy broker for a given |user_id|. Returns NULL if that |user_id|
 180   // does not belong to an existing device-local account.
 181   DeviceLocalAccountPolicyBroker* GetBrokerForUser(const std::string& user_id);
 182
 183   // Indicates whether policy has been successfully fetched for the given
 184   // |user_id|.
 185   bool IsPolicyAvailableForUser(const std::string& user_id);
 186
 187   void AddObserver(Observer* observer);
 188   void RemoveObserver(Observer* observer);
 189
 190  private:
 191   typedef std::map<std::string, DeviceLocalAccountPolicyBroker*>
 192       PolicyBrokerMap;
 193
 194   // Returns |true| if the directory in which force-installed extensions are
 195   // cached for |account_id| is busy, either because a broker that was using
 196   // this directory has not shut down completely yet or because the directory is
 197   // being deleted.
 198   bool IsExtensionCacheDirectoryBusy(const std::string& account_id);
 199
 200   // Starts any extension caches that are not running yet but can be started now
 201   // because their cache directories are no longer busy.
 202   void StartExtensionCachesIfPossible();
 203
 204   // Checks whether a broker exists for |account_id|. If so, starts the broker's
 205   // extension cache and returns |true|. Otherwise, returns |false|.
 206   bool StartExtensionCacheForAccountIfPresent(const std::string& account_id);
 207
 208   // Called back when any extension caches belonging to device-local accounts
 209   // that no longer exist have been removed at start-up.
 210   void OnOrphanedExtensionCachesDeleted();
 211
 212   // Called back when the extension cache for |account_id| has been shut down.
 213   void OnObsoleteExtensionCacheShutdown(const std::string& account_id);
 214
 215   // Called back when the extension cache for |account_id| has been removed.
 216   void OnObsoleteExtensionCacheDeleted(const std::string& account_id);
 217
 218   // Re-queries the list of defined device-local accounts from device settings
 219   // and updates |policy_brokers_| to match that list.
 220   void UpdateAccountList();
 221
 222   // Calls |UpdateAccountList| if there are no previous calls pending.
 223   void UpdateAccountListIfNonePending();
 224
 225   // Deletes brokers in |map| and clears it.
 226   void DeleteBrokers(PolicyBrokerMap* map);
 227
 228   // Find the broker for a given |store|. Returns NULL if |store| is unknown.
 229   DeviceLocalAccountPolicyBroker* GetBrokerForStore(CloudPolicyStore* store);
 230
 231   // Notifies the |observers_| that the policy for |user_id| has changed.
 232   void NotifyPolicyUpdated(const std::string& user_id);
 233
 234   ObserverList<Observer, true> observers_;
 235
 236   chromeos::SessionManagerClient* session_manager_client_;
 237   chromeos::DeviceSettingsService* device_settings_service_;
 238   chromeos::CrosSettings* cros_settings_;
 239   AffiliatedInvalidationServiceProvider* invalidation_service_provider_;
 240
 241   DeviceManagementService* device_management_service_;
 242
 243   // The device-local account policy brokers, keyed by user ID.
 244   PolicyBrokerMap policy_brokers_;
 245
 246   // Whether a call to UpdateAccountList() is pending because |cros_settings_|
 247   // are not trusted yet.
 248   bool waiting_for_cros_settings_;
 249
 250   // Orphaned extension caches are removed at startup. This tracks the status of
 251   // that process.
 252   enum OrphanExtensionCacheDeletionState {
 253     NOT_STARTED,
 254     IN_PROGRESS,
 255     DONE,
 256   };
 257   OrphanExtensionCacheDeletionState orphan_extension_cache_deletion_state_;
 258
 259   // Account IDs whose extension cache directories are busy, either because a
 260   // broker for the account has not shut down completely yet or because the
 261   // directory is being deleted.
 262   std::set<std::string> busy_extension_cache_directories_;
 263
 264   const scoped_refptr<base::SequencedTaskRunner> store_background_task_runner_;
 265   const scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner_;
 266
 267   scoped_ptr<DeviceLocalAccountExternalDataService> external_data_service_;
 268
 269   scoped_refptr<net::URLRequestContextGetter> request_context_;
 270
 271   const scoped_ptr<chromeos::CrosSettings::ObserverSubscription>
 272       local_accounts_subscription_;
 273
 274   // Path to the directory that contains the cached policy for components
 275   // for device-local accounts.
 276   base::FilePath component_policy_cache_root_;
 277
 278   base::WeakPtrFactory<DeviceLocalAccountPolicyService> weak_factory_;
 279
 280   DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyService);
 281 };
 282
 283 }  // namespace policy
 284
 285 #endif  // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_