chrome/browser/chromeos/policy/enterprise_install_attributes.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_
   6 #define CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_
   7
   8 #include <map>
   9 #include <string>
  10
  11 #include "base/basictypes.h"
  12 #include "base/callback.h"
  13 #include "base/compiler_specific.h"
  14 #include "base/files/file_path.h"
  15 #include "base/gtest_prod_util.h"
  16 #include "base/memory/weak_ptr.h"
  17 #include "chromeos/dbus/cryptohome_client.h"
  18 #include "chromeos/dbus/dbus_method_call_status.h"
  19 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
  20
  21 namespace policy {
  22
  23 // Brokers access to the enterprise-related installation-time attributes on
  24 // ChromeOS.
  25 // TODO(zelidrag, mnissler): Rename + move this class - http://crbug.com/249513.
  26 class EnterpriseInstallAttributes {
  27  public:
  28   // EnterpriseInstallAttributes status codes.  Do not change the numeric ids or
  29   // the meaning of the existing codes to preserve the interpretability of old
  30   // logfiles.
  31   enum LockResult {
  32     LOCK_SUCCESS = 0,          // Success.
  33     LOCK_NOT_READY = 1,        // Backend/TPM still initializing.
  34     LOCK_TIMEOUT = 2,          // Backend/TPM timed out.
  35     LOCK_BACKEND_INVALID = 3,  // Backend failed to initialize.
  36     LOCK_ALREADY_LOCKED = 4,   // TPM has already been locked.
  37     LOCK_SET_ERROR = 5,        // Failed to set attributes.
  38     LOCK_FINALIZE_ERROR = 6,   // Backend failed to lock.
  39     LOCK_READBACK_ERROR = 7,   // Inconsistency reading back registration data.
  40     LOCK_WRONG_DOMAIN = 8,     // Device already registered to another domain.
  41     LOCK_WRONG_MODE = 9,       // Device already locked to a different mode.
  42   };
  43
  44   // A callback to handle responses of methods returning a LockResult value.
  45   typedef base::Callback<void(LockResult lock_result)> LockResultCallback;
  46
  47   // Return serialized InstallAttributes of an enterprise-owned configuration.
  48   static std::string GetEnterpriseOwnedInstallAttributesBlobForTesting(
  49       const std::string& user_name);
  50
  51   explicit EnterpriseInstallAttributes(
  52       chromeos::CryptohomeClient* cryptohome_client);
  53   ~EnterpriseInstallAttributes();
  54
  55   // Tries to read install attributes from the cache file which is created early
  56   // during the boot process.  The cache file is used to work around slow
  57   // cryptohome startup, which takes a while to register its DBus interface.
  58   // (See http://crosbug.com/37367 for background on this.)
  59   void Init(const base::FilePath& cache_file);
  60
  61   // Makes sure the local caches for enterprise-related install attributes are
  62   // up-to-date with what cryptohome has. This method checks the readiness of
  63   // attributes and read them if ready. Actual read will be performed in
  64   // ReadAttributesIfReady().
  65   void ReadImmutableAttributes(const base::Closure& callback);
  66
  67   // Locks the device to be an enterprise device registered by the given user.
  68   // This can also be called after the lock has already been taken, in which
  69   // case it checks that the passed user agrees with the locked attribute.
  70   // |callback| must not be null and is called with the result.  Must not be
  71   // called while a previous LockDevice() invocation is still pending.
  72   void LockDevice(const std::string& user,
  73                   DeviceMode device_mode,
  74                   const std::string& device_id,
  75                   const LockResultCallback& callback);
  76
  77   // Checks whether this is an enterprise device.
  78   bool IsEnterpriseDevice() const;
  79
  80   // Checks whether this is a consumer kiosk enabled device.
  81   bool IsConsumerKioskDeviceWithAutoLaunch();
  82
  83   // Gets the domain this device belongs to or an empty string if the device is
  84   // not an enterprise device.
  85   std::string GetDomain() const;
  86
  87   // Gets the user that registered the device. Returns an empty string if the
  88   // device is not an enterprise device.
  89   std::string GetRegistrationUser();
  90
  91   // Gets the device id that was generated when the device was registered.
  92   // Returns an empty string if the device is not an enterprise device or the
  93   // device id was not stored in the lockbox (prior to R19).
  94   std::string GetDeviceId();
  95
  96   // Gets the mode the device was enrolled to. The return value for devices that
  97   // are not locked yet will be DEVICE_MODE_UNKNOWN.
  98   DeviceMode GetMode();
  99
 100  protected:
 101   // True if install attributes have been read successfully.  False if read
 102   // failed or no read attempt was made.
 103   bool device_locked_;
 104
 105   // Whether the TPM / install attributes consistency check is running.
 106   bool consistency_check_running_;
 107
 108   // To be run after the consistency check has finished.
 109   base::Closure post_check_action_;
 110
 111   // Wether the LockDevice() initiated TPM calls are running.
 112   bool device_lock_running_;
 113
 114   std::string registration_user_;
 115   std::string registration_domain_;
 116   std::string registration_device_id_;
 117   DeviceMode registration_mode_;
 118
 119  private:
 120   FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest,
 121                            DeviceLockedFromOlderVersion);
 122   FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest, Init);
 123   FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest,
 124                            InitForConsumerKiosk);
 125   FRIEND_TEST_ALL_PREFIXES(EnterpriseInstallAttributesTest,
 126                            VerifyFakeInstallAttributesCache);
 127
 128   // Constants for the possible device modes that can be stored in the lockbox.
 129   static const char kConsumerDeviceMode[];
 130   static const char kEnterpriseDeviceMode[];
 131   static const char kLegacyRetailDeviceMode[];
 132   static const char kConsumerKioskDeviceMode[];
 133   static const char kUnknownDeviceMode[];
 134
 135   // Field names in the lockbox.
 136   static const char kAttrEnterpriseDeviceId[];
 137   static const char kAttrEnterpriseDomain[];
 138   static const char kAttrEnterpriseMode[];
 139   static const char kAttrEnterpriseOwned[];
 140   static const char kAttrEnterpriseUser[];
 141   static const char kAttrConsumerKioskEnabled[];
 142
 143   // Translates DeviceMode constants to strings used in the lockbox.
 144   std::string GetDeviceModeString(DeviceMode mode);
 145
 146   // Translates strings used in the lockbox to DeviceMode values.
 147   DeviceMode GetDeviceModeFromString(const std::string& mode);
 148
 149   // Decodes the install attributes provided in |attr_map|.
 150   void DecodeInstallAttributes(
 151       const std::map<std::string, std::string>& attr_map);
 152
 153   // Helper for ReadImmutableAttributes.
 154   void ReadAttributesIfReady(
 155       const base::Closure& callback,
 156       chromeos::DBusMethodCallStatus call_status,
 157       bool result);
 158
 159   // Helper for LockDevice(). Handles the result of InstallAttributesIsReady()
 160   // and continue processing LockDevice if the result is true.
 161   void LockDeviceIfAttributesIsReady(
 162       const std::string& user,
 163       DeviceMode device_mode,
 164       const std::string& device_id,
 165       const LockResultCallback& callback,
 166       chromeos::DBusMethodCallStatus call_status,
 167       bool result);
 168
 169   // Confirms the registered user and invoke the callback.
 170   void OnReadImmutableAttributes(const std::string& user,
 171                                  const LockResultCallback& callback);
 172
 173   // Check state of install attributes against TPM lock state and generate UMA
 174   // for the result.  Asynchronously retry |dbus_retries| times in case of DBUS
 175   // errors (cryptohomed startup is slow).
 176   void TriggerConsistencyCheck(int dbus_retries);
 177
 178   // Callback for TpmIsOwned() DBUS call.  Generates UMA or schedules retry in
 179   // case of DBUS error.
 180   void OnTpmOwnerCheckCompleted(int dbus_retries_remaining,
 181                                 chromeos::DBusMethodCallStatus call_status,
 182                                 bool result);
 183
 184   chromeos::CryptohomeClient* cryptohome_client_;
 185
 186   base::WeakPtrFactory<EnterpriseInstallAttributes> weak_ptr_factory_;
 187
 188   DISALLOW_COPY_AND_ASSIGN(EnterpriseInstallAttributes);
 189 };
 190
 191 }  // namespace policy
 192
 193 #endif  // CHROME_BROWSER_CHROMEOS_POLICY_ENTERPRISE_INSTALL_ATTRIBUTES_H_