chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.h"
   6
   7 #include <string>
   8 #include <vector>
   9
  10 #include "base/callback.h"
  11 #include "base/json/json_reader.h"
  12 #include "base/json/json_writer.h"
  13 #include "base/logging.h"
  14 #include "base/memory/scoped_ptr.h"
  15 #include "base/prefs/pref_value_map.h"
  16 #include "base/strings/string_number_conversions.h"
  17 #include "base/strings/string_util.h"
  18 #include "base/values.h"
  19 #include "chrome/browser/ui/ash/chrome_launcher_prefs.h"
  20 #include "chrome/common/pref_names.h"
  21 #include "chromeos/dbus/power_policy_controller.h"
  22 #include "chromeos/network/onc/onc_signature.h"
  23 #include "chromeos/network/onc/onc_utils.h"
  24 #include "chromeos/network/onc/onc_validator.h"
  25 #include "components/onc/onc_constants.h"
  26 #include "components/policy/core/browser/policy_error_map.h"
  27 #include "components/policy/core/common/external_data_fetcher.h"
  28 #include "components/policy/core/common/policy_map.h"
  29 #include "components/policy/core/common/schema.h"
  30 #include "crypto/sha2.h"
  31 #include "grit/components_strings.h"
  32 #include "policy/policy_constants.h"
  33 #include "ui/chromeos/accessibility_types.h"
  34 #include "url/gurl.h"
  35
  36 namespace policy {
  37
  38 namespace {
  39
  40 const char kSubkeyURL[] = "url";
  41 const char kSubkeyHash[] = "hash";
  42
  43 bool GetSubkeyString(const base::DictionaryValue& dict,
  44                      policy::PolicyErrorMap* errors,
  45                      const std::string& policy,
  46                      const std::string& subkey,
  47                      std::string* value) {
  48   const base::Value* raw_value = NULL;
  49   if (!dict.GetWithoutPathExpansion(subkey, &raw_value)) {
  50     errors->AddError(policy, subkey, IDS_POLICY_NOT_SPECIFIED_ERROR);
  51     return false;
  52   }
  53   std::string string_value;
  54   if (!raw_value->GetAsString(&string_value)) {
  55     errors->AddError(policy, subkey, IDS_POLICY_TYPE_ERROR, "string");
  56     return false;
  57   }
  58   if (string_value.empty()) {
  59     errors->AddError(policy, subkey, IDS_POLICY_NOT_SPECIFIED_ERROR);
  60     return false;
  61   }
  62   *value = string_value;
  63   return true;
  64 }
  65
  66 const char kScreenDimDelayAC[] = "AC.Delays.ScreenDim";
  67 const char kScreenOffDelayAC[] = "AC.Delays.ScreenOff";
  68 const char kIdleWarningDelayAC[] = "AC.Delays.IdleWarning";
  69 const char kIdleDelayAC[] = "AC.Delays.Idle";
  70 const char kIdleActionAC[] = "AC.IdleAction";
  71
  72 const char kScreenDimDelayBattery[] = "Battery.Delays.ScreenDim";
  73 const char kScreenOffDelayBattery[] = "Battery.Delays.ScreenOff";
  74 const char kIdleWarningDelayBattery[] = "Battery.Delays.IdleWarning";
  75 const char kIdleDelayBattery[] = "Battery.Delays.Idle";
  76 const char kIdleActionBattery[] = "Battery.IdleAction";
  77
  78 const char kScreenLockDelayAC[] = "AC";
  79 const char kScreenLockDelayBattery[] = "Battery";
  80
  81 const char kActionSuspend[] = "Suspend";
  82 const char kActionLogout[] = "Logout";
  83 const char kActionShutdown[]  = "Shutdown";
  84 const char kActionDoNothing[] = "DoNothing";
  85
  86 scoped_ptr<base::Value> GetValue(const base::DictionaryValue* dict,
  87                                  const char* key) {
  88   const base::Value* value = NULL;
  89   if (!dict->Get(key, &value))
  90     return scoped_ptr<base::Value>();
  91   return value->CreateDeepCopy();
  92 }
  93
  94 scoped_ptr<base::Value> GetAction(const base::DictionaryValue* dict,
  95                                   const char* key) {
  96   scoped_ptr<base::Value> value = GetValue(dict, key);
  97   std::string action;
  98   if (!value || !value->GetAsString(&action))
  99     return scoped_ptr<base::Value>();
 100   if (action == kActionSuspend) {
 101     return scoped_ptr<base::Value>(new base::FundamentalValue(
 102         chromeos::PowerPolicyController::ACTION_SUSPEND));
 103   }
 104   if (action == kActionLogout) {
 105     return scoped_ptr<base::Value>(new base::FundamentalValue(
 106         chromeos::PowerPolicyController::ACTION_STOP_SESSION));
 107   }
 108   if (action == kActionShutdown) {
 109     return scoped_ptr<base::Value>(new base::FundamentalValue(
 110         chromeos::PowerPolicyController::ACTION_SHUT_DOWN));
 111   }
 112   if (action == kActionDoNothing) {
 113     return scoped_ptr<base::Value>(new base::FundamentalValue(
 114         chromeos::PowerPolicyController::ACTION_DO_NOTHING));
 115   }
 116   return scoped_ptr<base::Value>();
 117 }
 118
 119 }  // namespace
 120
 121 ExternalDataPolicyHandler::ExternalDataPolicyHandler(const char* policy_name)
 122     : TypeCheckingPolicyHandler(policy_name, base::Value::TYPE_DICTIONARY) {
 123 }
 124
 125 ExternalDataPolicyHandler::~ExternalDataPolicyHandler() {
 126 }
 127
 128 bool ExternalDataPolicyHandler::CheckPolicySettings(const PolicyMap& policies,
 129                                                     PolicyErrorMap* errors) {
 130   if (!TypeCheckingPolicyHandler::CheckPolicySettings(policies, errors))
 131     return false;
 132
 133   const std::string policy = policy_name();
 134   const base::Value* value = policies.GetValue(policy);
 135   if (!value)
 136     return true;
 137
 138   const base::DictionaryValue* dict = NULL;
 139   value->GetAsDictionary(&dict);
 140   if (!dict) {
 141     NOTREACHED();
 142     return false;
 143   }
 144   std::string url_string;
 145   std::string hash_string;
 146   if (!GetSubkeyString(*dict, errors, policy, kSubkeyURL, &url_string) ||
 147       !GetSubkeyString(*dict, errors, policy, kSubkeyHash, &hash_string)) {
 148     return false;
 149   }
 150
 151   const GURL url(url_string);
 152   if (!url.is_valid()) {
 153     errors->AddError(policy, kSubkeyURL, IDS_POLICY_VALUE_FORMAT_ERROR);
 154     return false;
 155   }
 156
 157   std::vector<uint8> hash;
 158   if (!base::HexStringToBytes(hash_string, &hash) ||
 159       hash.size() != crypto::kSHA256Length) {
 160     errors->AddError(policy, kSubkeyHash, IDS_POLICY_VALUE_FORMAT_ERROR);
 161     return false;
 162   }
 163
 164   return true;
 165 }
 166
 167 void ExternalDataPolicyHandler::ApplyPolicySettings(const PolicyMap& policies,
 168                                                     PrefValueMap* prefs) {
 169 }
 170
 171 // static
 172 NetworkConfigurationPolicyHandler*
 173 NetworkConfigurationPolicyHandler::CreateForUserPolicy() {
 174   return new NetworkConfigurationPolicyHandler(
 175       key::kOpenNetworkConfiguration,
 176       onc::ONC_SOURCE_USER_POLICY,
 177       prefs::kOpenNetworkConfiguration);
 178 }
 179
 180 // static
 181 NetworkConfigurationPolicyHandler*
 182 NetworkConfigurationPolicyHandler::CreateForDevicePolicy() {
 183   return new NetworkConfigurationPolicyHandler(
 184       key::kDeviceOpenNetworkConfiguration,
 185       onc::ONC_SOURCE_DEVICE_POLICY,
 186       prefs::kDeviceOpenNetworkConfiguration);
 187 }
 188
 189 NetworkConfigurationPolicyHandler::~NetworkConfigurationPolicyHandler() {}
 190
 191 bool NetworkConfigurationPolicyHandler::CheckPolicySettings(
 192     const PolicyMap& policies,
 193     PolicyErrorMap* errors) {
 194   const base::Value* value;
 195   if (!CheckAndGetValue(policies, errors, &value))
 196     return false;
 197
 198   if (value) {
 199     std::string onc_blob;
 200     value->GetAsString(&onc_blob);
 201     scoped_ptr<base::DictionaryValue> root_dict =
 202         chromeos::onc::ReadDictionaryFromJson(onc_blob);
 203     if (root_dict.get() == NULL) {
 204       errors->AddError(policy_name(), IDS_POLICY_NETWORK_CONFIG_PARSE_FAILED);
 205       return false;
 206     }
 207
 208     // Validate the ONC dictionary. We are liberal and ignore unknown field
 209     // names and ignore invalid field names in kRecommended arrays.
 210     chromeos::onc::Validator validator(
 211         false,  // Ignore unknown fields.
 212         false,  // Ignore invalid recommended field names.
 213         true,   // Fail on missing fields.
 214         true);  // Validate for managed ONC
 215     validator.SetOncSource(onc_source_);
 216
 217     // ONC policies are always unencrypted.
 218     chromeos::onc::Validator::Result validation_result;
 219     root_dict = validator.ValidateAndRepairObject(
 220         &chromeos::onc::kToplevelConfigurationSignature, *root_dict,
 221         &validation_result);
 222     if (validation_result == chromeos::onc::Validator::VALID_WITH_WARNINGS)
 223       errors->AddError(policy_name(), IDS_POLICY_NETWORK_CONFIG_IMPORT_PARTIAL);
 224     else if (validation_result == chromeos::onc::Validator::INVALID)
 225       errors->AddError(policy_name(), IDS_POLICY_NETWORK_CONFIG_IMPORT_FAILED);
 226
 227     // In any case, don't reject the policy as some networks or certificates
 228     // could still be applied.
 229   }
 230
 231   return true;
 232 }
 233
 234 void NetworkConfigurationPolicyHandler::ApplyPolicySettings(
 235     const PolicyMap& policies,
 236     PrefValueMap* prefs) {
 237   const base::Value* value = policies.GetValue(policy_name());
 238   if (!value)
 239     return;
 240
 241   std::string onc_blob;
 242   value->GetAsString(&onc_blob);
 243
 244   scoped_ptr<base::ListValue> network_configs(new base::ListValue);
 245   base::ListValue certificates;
 246   base::DictionaryValue global_network_config;
 247   chromeos::onc::ParseAndValidateOncForImport(onc_blob,
 248                                               onc_source_,
 249                                               "",
 250                                               network_configs.get(),
 251                                               &global_network_config,
 252                                               &certificates);
 253
 254   // Currently, only the per-network configuration is stored in a pref. Ignore
 255   // |global_network_config| and |certificates|.
 256   prefs->SetValue(pref_path_, network_configs.Pass());
 257 }
 258
 259 void NetworkConfigurationPolicyHandler::PrepareForDisplaying(
 260     PolicyMap* policies) const {
 261   const PolicyMap::Entry* entry = policies->Get(policy_name());
 262   if (!entry)
 263     return;
 264   base::Value* sanitized_config = SanitizeNetworkConfig(entry->value);
 265   if (!sanitized_config)
 266     sanitized_config = base::Value::CreateNullValue().release();
 267
 268   policies->Set(policy_name(), entry->level, entry->scope,
 269                 entry->source, sanitized_config, nullptr);
 270 }
 271
 272 NetworkConfigurationPolicyHandler::NetworkConfigurationPolicyHandler(
 273     const char* policy_name,
 274     onc::ONCSource onc_source,
 275     const char* pref_path)
 276     : TypeCheckingPolicyHandler(policy_name, base::Value::TYPE_STRING),
 277       onc_source_(onc_source),
 278       pref_path_(pref_path) {
 279 }
 280
 281 // static
 282 base::Value* NetworkConfigurationPolicyHandler::SanitizeNetworkConfig(
 283     const base::Value* config) {
 284   std::string json_string;
 285   if (!config->GetAsString(&json_string))
 286     return NULL;
 287
 288   scoped_ptr<base::DictionaryValue> toplevel_dict =
 289       chromeos::onc::ReadDictionaryFromJson(json_string);
 290   if (!toplevel_dict)
 291     return NULL;
 292
 293   // Placeholder to insert in place of the filtered setting.
 294   const char kPlaceholder[] = "********";
 295
 296   toplevel_dict = chromeos::onc::MaskCredentialsInOncObject(
 297       chromeos::onc::kToplevelConfigurationSignature,
 298       *toplevel_dict,
 299       kPlaceholder);
 300
 301   base::JSONWriter::WriteWithOptions(
 302       *toplevel_dict, base::JSONWriter::OPTIONS_PRETTY_PRINT, &json_string);
 303   return new base::StringValue(json_string);
 304 }
 305
 306 PinnedLauncherAppsPolicyHandler::PinnedLauncherAppsPolicyHandler()
 307     : ExtensionListPolicyHandler(key::kPinnedLauncherApps,
 308                                  prefs::kPinnedLauncherApps,
 309                                  false) {}
 310
 311 PinnedLauncherAppsPolicyHandler::~PinnedLauncherAppsPolicyHandler() {}
 312
 313 void PinnedLauncherAppsPolicyHandler::ApplyPolicySettings(
 314     const PolicyMap& policies,
 315     PrefValueMap* prefs) {
 316   PolicyErrorMap errors;
 317   const base::Value* policy_value = policies.GetValue(policy_name());
 318   const base::ListValue* policy_list = NULL;
 319   if (policy_value && policy_value->GetAsList(&policy_list) && policy_list) {
 320     scoped_ptr<base::ListValue> pinned_apps_list(new base::ListValue());
 321     for (base::ListValue::const_iterator entry(policy_list->begin());
 322          entry != policy_list->end(); ++entry) {
 323       std::string id;
 324       if ((*entry)->GetAsString(&id)) {
 325         base::DictionaryValue* app_dict = new base::DictionaryValue();
 326         app_dict->SetString(ash::kPinnedAppsPrefAppIDPath, id);
 327         pinned_apps_list->Append(app_dict);
 328       }
 329     }
 330     prefs->SetValue(pref_path(), pinned_apps_list.Pass());
 331   }
 332 }
 333
 334 ScreenMagnifierPolicyHandler::ScreenMagnifierPolicyHandler()
 335     : IntRangePolicyHandlerBase(key::kScreenMagnifierType,
 336                                 0, ui::MAGNIFIER_FULL, false) {
 337 }
 338
 339 ScreenMagnifierPolicyHandler::~ScreenMagnifierPolicyHandler() {
 340 }
 341
 342 void ScreenMagnifierPolicyHandler::ApplyPolicySettings(
 343     const PolicyMap& policies,
 344     PrefValueMap* prefs) {
 345   const base::Value* value = policies.GetValue(policy_name());
 346   int value_in_range;
 347   if (value && EnsureInRange(value, &value_in_range, NULL)) {
 348     prefs->SetBoolean(prefs::kAccessibilityScreenMagnifierEnabled,
 349                       value_in_range != 0);
 350     prefs->SetInteger(prefs::kAccessibilityScreenMagnifierType, value_in_range);
 351   }
 352 }
 353
 354 LoginScreenPowerManagementPolicyHandler::
 355     LoginScreenPowerManagementPolicyHandler(const Schema& chrome_schema)
 356     : SchemaValidatingPolicyHandler(key::kDeviceLoginScreenPowerManagement,
 357                                     chrome_schema.GetKnownProperty(
 358                                         key::kDeviceLoginScreenPowerManagement),
 359                                     SCHEMA_ALLOW_UNKNOWN) {
 360 }
 361
 362 LoginScreenPowerManagementPolicyHandler::
 363     ~LoginScreenPowerManagementPolicyHandler() {
 364 }
 365
 366 void LoginScreenPowerManagementPolicyHandler::ApplyPolicySettings(
 367     const PolicyMap& policies,
 368     PrefValueMap* prefs) {
 369 }
 370
 371 DeprecatedIdleActionHandler::DeprecatedIdleActionHandler()
 372     : IntRangePolicyHandlerBase(
 373           key::kIdleAction,
 374           chromeos::PowerPolicyController::ACTION_SUSPEND,
 375           chromeos::PowerPolicyController::ACTION_DO_NOTHING,
 376           false) {}
 377
 378 DeprecatedIdleActionHandler::~DeprecatedIdleActionHandler() {}
 379
 380 void DeprecatedIdleActionHandler::ApplyPolicySettings(const PolicyMap& policies,
 381                                                       PrefValueMap* prefs) {
 382   const base::Value* value = policies.GetValue(policy_name());
 383   if (value && EnsureInRange(value, NULL, NULL)) {
 384     if (!prefs->GetValue(prefs::kPowerAcIdleAction, NULL))
 385       prefs->SetValue(prefs::kPowerAcIdleAction, value->CreateDeepCopy());
 386     if (!prefs->GetValue(prefs::kPowerBatteryIdleAction, NULL))
 387       prefs->SetValue(prefs::kPowerBatteryIdleAction, value->CreateDeepCopy());
 388   }
 389 }
 390
 391 PowerManagementIdleSettingsPolicyHandler::
 392     PowerManagementIdleSettingsPolicyHandler(const Schema& chrome_schema)
 393     : SchemaValidatingPolicyHandler(
 394           key::kPowerManagementIdleSettings,
 395           chrome_schema.GetKnownProperty(key::kPowerManagementIdleSettings),
 396           SCHEMA_ALLOW_UNKNOWN) {
 397 }
 398
 399 PowerManagementIdleSettingsPolicyHandler::
 400     ~PowerManagementIdleSettingsPolicyHandler() {
 401 }
 402
 403 void PowerManagementIdleSettingsPolicyHandler::ApplyPolicySettings(
 404     const PolicyMap& policies,
 405     PrefValueMap* prefs) {
 406   scoped_ptr<base::Value> policy_value;
 407   if (!CheckAndGetValue(policies, NULL, &policy_value))
 408     return;
 409   const base::DictionaryValue* dict = NULL;
 410   if (!policy_value->GetAsDictionary(&dict)) {
 411     NOTREACHED();
 412     return;
 413   }
 414   scoped_ptr<base::Value> value;
 415
 416   value = GetValue(dict, kScreenDimDelayAC);
 417   if (value)
 418     prefs->SetValue(prefs::kPowerAcScreenDimDelayMs, value.Pass());
 419   value = GetValue(dict, kScreenOffDelayAC);
 420   if (value)
 421     prefs->SetValue(prefs::kPowerAcScreenOffDelayMs, value.Pass());
 422   value = GetValue(dict, kIdleWarningDelayAC);
 423   if (value)
 424     prefs->SetValue(prefs::kPowerAcIdleWarningDelayMs, value.Pass());
 425   value = GetValue(dict, kIdleDelayAC);
 426   if (value)
 427     prefs->SetValue(prefs::kPowerAcIdleDelayMs, value.Pass());
 428   value = GetAction(dict, kIdleActionAC);
 429   if (value)
 430     prefs->SetValue(prefs::kPowerAcIdleAction, value.Pass());
 431
 432   value = GetValue(dict, kScreenDimDelayBattery);
 433   if (value)
 434     prefs->SetValue(prefs::kPowerBatteryScreenDimDelayMs, value.Pass());
 435   value = GetValue(dict, kScreenOffDelayBattery);
 436   if (value)
 437     prefs->SetValue(prefs::kPowerBatteryScreenOffDelayMs, value.Pass());
 438   value = GetValue(dict, kIdleWarningDelayBattery);
 439   if (value)
 440     prefs->SetValue(prefs::kPowerBatteryIdleWarningDelayMs, value.Pass());
 441   value = GetValue(dict, kIdleDelayBattery);
 442   if (value)
 443     prefs->SetValue(prefs::kPowerBatteryIdleDelayMs, value.Pass());
 444   value = GetAction(dict, kIdleActionBattery);
 445   if (value)
 446     prefs->SetValue(prefs::kPowerBatteryIdleAction, value.Pass());
 447 }
 448
 449 ScreenLockDelayPolicyHandler::ScreenLockDelayPolicyHandler(
 450     const Schema& chrome_schema)
 451     : SchemaValidatingPolicyHandler(
 452           key::kScreenLockDelays,
 453           chrome_schema.GetKnownProperty(key::kScreenLockDelays),
 454           SCHEMA_ALLOW_UNKNOWN) {
 455 }
 456
 457 ScreenLockDelayPolicyHandler::~ScreenLockDelayPolicyHandler() {
 458 }
 459
 460 void ScreenLockDelayPolicyHandler::ApplyPolicySettings(
 461     const PolicyMap& policies,
 462     PrefValueMap* prefs) {
 463   scoped_ptr<base::Value> policy_value;
 464   if (!CheckAndGetValue(policies, NULL, &policy_value))
 465     return;
 466   const base::DictionaryValue* dict = NULL;
 467   if (!policy_value->GetAsDictionary(&dict)) {
 468     NOTREACHED();
 469     return;
 470   }
 471   scoped_ptr<base::Value> value;
 472
 473   value = GetValue(dict, kScreenLockDelayAC);
 474   if (value)
 475     prefs->SetValue(prefs::kPowerAcScreenLockDelayMs, value.Pass());
 476   value = GetValue(dict, kScreenLockDelayBattery);
 477   if (value)
 478     prefs->SetValue(prefs::kPowerBatteryScreenLockDelayMs, value.Pass());
 479 }
 480
 481 }  // namespace policy