chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.h"
   6
   7 #include "base/bind.h"
   8 #include "base/command_line.h"
   9 #include "base/files/file_path.h"
  10 #include "base/logging.h"
  11 #include "base/memory/ref_counted.h"
  12 #include "base/message_loop/message_loop_proxy.h"
  13 #include "base/path_service.h"
  14 #include "base/sequenced_task_runner.h"
  15 #include "base/threading/sequenced_worker_pool.h"
  16 #include "base/time/time.h"
  17 #include "chrome/browser/browser_process.h"
  18 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
  19 #include "chrome/browser/chromeos/policy/user_cloud_external_data_manager.h"
  20 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h"
  21 #include "chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos.h"
  22 #include "chrome/browser/chromeos/profiles/profile_helper.h"
  23 #include "chrome/browser/chromeos/settings/cros_settings.h"
  24 #include "chrome/browser/policy/schema_registry_service.h"
  25 #include "chrome/browser/policy/schema_registry_service_factory.h"
  26 #include "chrome/browser/profiles/profile.h"
  27 #include "chromeos/chromeos_paths.h"
  28 #include "chromeos/chromeos_switches.h"
  29 #include "chromeos/dbus/dbus_thread_manager.h"
  30 #include "components/keyed_service/content/browser_context_dependency_manager.h"
  31 #include "components/policy/core/browser/browser_policy_connector.h"
  32 #include "components/policy/core/common/cloud/cloud_external_data_manager.h"
  33 #include "components/policy/core/common/cloud/device_management_service.h"
  34 #include "components/user_manager/user.h"
  35 #include "components/user_manager/user_manager.h"
  36 #include "content/public/browser/browser_thread.h"
  37 #include "net/url_request/url_request_context_getter.h"
  38 #include "policy/policy_constants.h"
  39
  40 namespace policy {
  41
  42 namespace {
  43
  44 // Subdirectory in the user's profile for storing legacy user policies.
  45 const base::FilePath::CharType kDeviceManagementDir[] =
  46     FILE_PATH_LITERAL("Device Management");
  47
  48 // File in the above directory for storing legacy user policy dmtokens.
  49 const base::FilePath::CharType kToken[] = FILE_PATH_LITERAL("Token");
  50
  51 // This constant is used to build two different paths. It can be a file inside
  52 // kDeviceManagementDir where legacy user policy data is stored, and it can be
  53 // a directory inside the profile directory where other resources are stored.
  54 const base::FilePath::CharType kPolicy[] = FILE_PATH_LITERAL("Policy");
  55
  56 // Directory under kPolicy, in the user's profile dir, where policy for
  57 // components is cached.
  58 const base::FilePath::CharType kComponentsDir[] =
  59     FILE_PATH_LITERAL("Components");
  60
  61 // Directory in which to store external policy data. This is specified relative
  62 // to kPolicy.
  63 const base::FilePath::CharType kPolicyExternalDataDir[] =
  64     FILE_PATH_LITERAL("External Data");
  65
  66 // Timeout in seconds after which to abandon the initial policy fetch and start
  67 // the session regardless.
  68 const int kInitialPolicyFetchTimeoutSeconds = 10;
  69
  70 }  // namespace
  71
  72 // static
  73 UserCloudPolicyManagerFactoryChromeOS*
  74     UserCloudPolicyManagerFactoryChromeOS::GetInstance() {
  75   return Singleton<UserCloudPolicyManagerFactoryChromeOS>::get();
  76 }
  77
  78 // static
  79 UserCloudPolicyManagerChromeOS*
  80     UserCloudPolicyManagerFactoryChromeOS::GetForProfile(
  81         Profile* profile) {
  82   return GetInstance()->GetManagerForProfile(profile);
  83 }
  84
  85 // static
  86 scoped_ptr<UserCloudPolicyManagerChromeOS>
  87     UserCloudPolicyManagerFactoryChromeOS::CreateForProfile(
  88         Profile* profile,
  89         bool force_immediate_load,
  90         scoped_refptr<base::SequencedTaskRunner> background_task_runner) {
  91   return GetInstance()->CreateManagerForProfile(
  92       profile, force_immediate_load, background_task_runner);
  93 }
  94
  95 UserCloudPolicyManagerFactoryChromeOS::UserCloudPolicyManagerFactoryChromeOS()
  96     : BrowserContextKeyedBaseFactory(
  97         "UserCloudPolicyManagerChromeOS",
  98         BrowserContextDependencyManager::GetInstance()) {
  99   DependsOn(SchemaRegistryServiceFactory::GetInstance());
 100 }
 101
 102 UserCloudPolicyManagerFactoryChromeOS::
 103     ~UserCloudPolicyManagerFactoryChromeOS() {}
 104
 105 UserCloudPolicyManagerChromeOS*
 106     UserCloudPolicyManagerFactoryChromeOS::GetManagerForProfile(
 107         Profile* profile) {
 108   // Get the manager for the original profile, since the PolicyService is
 109   // also shared between the incognito Profile and the original Profile.
 110   ManagerMap::const_iterator it = managers_.find(profile->GetOriginalProfile());
 111   return it != managers_.end() ? it->second : NULL;
 112 }
 113
 114 scoped_ptr<UserCloudPolicyManagerChromeOS>
 115     UserCloudPolicyManagerFactoryChromeOS::CreateManagerForProfile(
 116         Profile* profile,
 117         bool force_immediate_load,
 118         scoped_refptr<base::SequencedTaskRunner> background_task_runner) {
 119   const base::CommandLine* command_line =
 120       base::CommandLine::ForCurrentProcess();
 121   // Don't initialize cloud policy for the signin profile.
 122   if (chromeos::ProfileHelper::IsSigninProfile(profile))
 123     return scoped_ptr<UserCloudPolicyManagerChromeOS>();
 124
 125   // |user| should never be NULL except for the signin profile. This object is
 126   // created as part of the Profile creation, which happens right after
 127   // sign-in. The just-signed-in User is the active user during that time.
 128   const user_manager::User* user =
 129       chromeos::ProfileHelper::Get()->GetUserByProfile(profile);
 130   CHECK(user);
 131
 132   // User policy exists for enterprise accounts only:
 133   // - For regular enterprise users (those who have a GAIA account), a
 134   //   |UserCloudPolicyManagerChromeOS| is created here.
 135   // - For device-local accounts, policy is provided by
 136   //   |DeviceLocalAccountPolicyService|.
 137   // All other user types do not have user policy.
 138   const std::string& username = user->email();
 139   if (!user->HasGaiaAccount() ||
 140       user->IsSupervised() ||
 141       BrowserPolicyConnector::IsNonEnterpriseUser(username)) {
 142     return scoped_ptr<UserCloudPolicyManagerChromeOS>();
 143   }
 144
 145   policy::BrowserPolicyConnectorChromeOS* connector =
 146       g_browser_process->platform_part()->browser_policy_connector_chromeos();
 147   UserAffiliation affiliation = connector->GetUserAffiliation(username);
 148   const bool is_affiliated_user = affiliation == USER_AFFILIATION_MANAGED;
 149   const bool is_browser_restart =
 150       command_line->HasSwitch(chromeos::switches::kLoginUser);
 151   const bool wait_for_initial_policy =
 152       !is_browser_restart &&
 153       (user_manager::UserManager::Get()->IsCurrentUserNew() ||
 154        is_affiliated_user);
 155
 156   const base::TimeDelta initial_policy_fetch_timeout =
 157       user_manager::UserManager::Get()->IsCurrentUserNew()
 158           ? base::TimeDelta::Max()
 159           : base::TimeDelta::FromSeconds(kInitialPolicyFetchTimeoutSeconds);
 160
 161   DeviceManagementService* device_management_service =
 162       connector->device_management_service();
 163   if (wait_for_initial_policy)
 164     device_management_service->ScheduleInitialization(0);
 165
 166   base::FilePath profile_dir = profile->GetPath();
 167   const base::FilePath legacy_dir = profile_dir.Append(kDeviceManagementDir);
 168   const base::FilePath policy_cache_file = legacy_dir.Append(kPolicy);
 169   const base::FilePath token_cache_file = legacy_dir.Append(kToken);
 170   const base::FilePath component_policy_cache_dir =
 171       profile_dir.Append(kPolicy).Append(kComponentsDir);
 172   const base::FilePath external_data_dir =
 173         profile_dir.Append(kPolicy).Append(kPolicyExternalDataDir);
 174   base::FilePath policy_key_dir;
 175   CHECK(PathService::Get(chromeos::DIR_USER_POLICY_KEYS, &policy_key_dir));
 176
 177   scoped_ptr<UserCloudPolicyStoreChromeOS> store(
 178       new UserCloudPolicyStoreChromeOS(
 179           chromeos::DBusThreadManager::Get()->GetCryptohomeClient(),
 180           chromeos::DBusThreadManager::Get()->GetSessionManagerClient(),
 181           background_task_runner,
 182           username, policy_key_dir, token_cache_file, policy_cache_file));
 183
 184   scoped_refptr<base::SequencedTaskRunner> backend_task_runner =
 185       content::BrowserThread::GetBlockingPool()->GetSequencedTaskRunner(
 186           content::BrowserThread::GetBlockingPool()->GetSequenceToken());
 187   scoped_refptr<base::SequencedTaskRunner> io_task_runner =
 188       content::BrowserThread::GetMessageLoopProxyForThread(
 189           content::BrowserThread::IO);
 190   scoped_ptr<CloudExternalDataManager> external_data_manager(
 191       new UserCloudExternalDataManager(base::Bind(&GetChromePolicyDetails),
 192                                        backend_task_runner,
 193                                        io_task_runner,
 194                                        external_data_dir,
 195                                        store.get()));
 196   if (force_immediate_load)
 197     store->LoadImmediately();
 198
 199   scoped_refptr<base::SequencedTaskRunner> file_task_runner =
 200       content::BrowserThread::GetMessageLoopProxyForThread(
 201           content::BrowserThread::FILE);
 202
 203   scoped_ptr<UserCloudPolicyManagerChromeOS> manager(
 204       new UserCloudPolicyManagerChromeOS(store.Pass(),
 205                                          external_data_manager.Pass(),
 206                                          component_policy_cache_dir,
 207                                          wait_for_initial_policy,
 208                                          initial_policy_fetch_timeout,
 209                                          base::MessageLoopProxy::current(),
 210                                          file_task_runner,
 211                                          io_task_runner));
 212
 213   bool wildcard_match = false;
 214   if (connector->IsEnterpriseManaged() &&
 215       chromeos::CrosSettings::IsWhitelisted(username, &wildcard_match) &&
 216       wildcard_match && !connector->IsNonEnterpriseUser(username)) {
 217     manager->EnableWildcardLoginCheck(username);
 218   }
 219
 220   manager->Init(
 221       SchemaRegistryServiceFactory::GetForContext(profile)->registry());
 222   manager->Connect(g_browser_process->local_state(),
 223                    device_management_service,
 224                    g_browser_process->system_request_context(),
 225                    affiliation);
 226
 227   DCHECK(managers_.find(profile) == managers_.end());
 228   managers_[profile] = manager.get();
 229   return manager.Pass();
 230 }
 231
 232 void UserCloudPolicyManagerFactoryChromeOS::BrowserContextShutdown(
 233     content::BrowserContext* context) {
 234   Profile* profile = static_cast<Profile*>(context);
 235   if (profile->IsOffTheRecord())
 236     return;
 237   UserCloudPolicyManagerChromeOS* manager = GetManagerForProfile(profile);
 238   if (manager)
 239     manager->Shutdown();
 240 }
 241
 242 void UserCloudPolicyManagerFactoryChromeOS::BrowserContextDestroyed(
 243     content::BrowserContext* context) {
 244   Profile* profile = static_cast<Profile*>(context);
 245   managers_.erase(profile);
 246   BrowserContextKeyedBaseFactory::BrowserContextDestroyed(context);
 247 }
 248
 249 void UserCloudPolicyManagerFactoryChromeOS::SetEmptyTestingFactory(
 250     content::BrowserContext* context) {}
 251
 252 bool UserCloudPolicyManagerFactoryChromeOS::HasTestingFactory(
 253     content::BrowserContext* context) {
 254   return false;
 255 }
 256
 257 void UserCloudPolicyManagerFactoryChromeOS::CreateServiceNow(
 258     content::BrowserContext* context) {}
 259
 260 }  // namespace policy