1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
|
// Copyright 2013 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
#include <string>
#include "base/logging.h"
#include "base/strings/utf_string_conversions.h"
#include "chrome/grit/generated_resources.h"
#include "extensions/common/extension.h"
#include "extensions/common/manifest.h"
#include "ui/base/l10n/l10n_util.h"
namespace chromeos {
namespace {
// Apps/extensions explicitly whitelisted for use in public sessions.
const char* const kPublicSessionWhitelist[] = {
// Public sessions in general:
"cbkkbcmdlboombapidmoeolnmdacpkch", // Chrome RDP
"djflhoibgkdhkhhcedjiklpkjnoahfmg", // User Agent Switcher
"iabmpiboiopbgfabjmgeedhcmjenhbla", // VNC Viewer
"haiffjcadagjlijoggckpgfnoeiflnem", // Citrix Receiver
"mfaihdlpglflfgpfjcifdjdjcckigekc", // ARC Runtime
// Libraries:
"aclofikceldphonlfmghmimkodjdmhck", // Ancoris login component
"eilbnahdgoddoedakcmfkcgfoegeloil", // Ancoris proxy component
"ceehlgckkmkaoggdnjhibffkphfnphmg", // Libdata login
// Retail mode:
"bjfeaefhaooblkndnoabbkkkenknkemb", // 500 px demo
"ehcabepphndocfmgbdkbjibfodelmpbb", // Angry Birds demo
"kgimkbnclbekdkabkpjhpakhhalfanda", // Bejeweled demo
"joodangkbfjnajiiifokapkpmhfnpleo", // Calculator
"fpgfohogebplgnamlafljlcidjedbdeb", // Calendar demo
"hfhhnacclhffhdffklopdkcgdhifgngh", // Camera
"cdjikkcakjcdjemakobkmijmikhkegcj", // Chrome Remote Desktop demo
"jkoildpomkimndcphjpffmephmcmkfhn", // Chromebook Demo App
"lbhdhapagjhalobandnbdnmblnmocojh", // Crackle demo
"ielkookhdphmgbipcfmafkaiagademfp", // Custom bookmarks
"kogjlbfgggambihdjcpijgcbmenblimd", // Custom bookmarks
"ogbkmlkceflgpilgbmbcfbifckpkfacf", // Custom bookmarks
"pbbbjjecobhljkkcenlakfnkmkfkfamd", // Custom bookmarks
"jkbfjmnjcdmhlfpephomoiipbhcoiffb", // Custom bookmarks
"dgmblbpgafgcgpkoiilhjifindhinmai", // Custom bookmarks
"iggnealjakkgfofealilhkkclnbnfnmo", // Custom bookmarks
"lplkobnahgbopmpkdapaihnnojkphahc", // Custom bookmarks
"lejnflfhjpcannpaghnahbedlabpmhoh", // Custom bookmarks
"dhjmfhojkfjmfbnbnpichdmcdghdpccg", // Cut the Rope demo
"ebkhfdfghngbimnpgelagnfacdafhaba", // Deezer demo
"npnjdccdffhdndcbeappiamcehbhjibf", // Docs.app demo
"ekgadegabdkcbkodfbgidncffijbghhl", // Duolingo demo
"iddohohhpmajlkbejjjcfednjnhlnenk", // Evernote demo
"bjdhhokmhgelphffoafoejjmlfblpdha", // Gmail demo
"mdhnphfgagkpdhndljccoackjjhghlif", // Google Drive demo
"dondgdlndnpianbklfnehgdhkickdjck", // Google Keep demo
"amfoiggnkefambnaaphodjdmdooiinna", // Google Play Movie and TV demo
"fgjnkhlabjcaajddbaenilcmpcidahll", // Google+ demo
"ifpkhncdnjfipfjlhfidljjffdgklanh", // Google+ Photos demo
"cgmlfbhkckbedohgdepgbkflommbfkep", // Hangouts.app demo
"edhhaiphkklkcfcbnlbpbiepchnkgkpn", // Helper.extension demo
"jckncghadoodfbbbmbpldacojkooophh", // Journal demo
"diehajhcjifpahdplfdkhiboknagmfii", // Kindle demo
"idneggepppginmaklfbaniklagjghpio", // Kingsroad demo
"nhpmmldpbfjofkipjaieeomhnmcgihfm", // Menu.app demo
"kcjbmmhccecjokfmckhddpmghepcnidb", // Mint demo
"onbhgdmifjebcabplolilidlpgeknifi", // Music.app demo
"kkkbcoabfhgekpnddfkaphobhinociem", // Netflix demo
"adlphlfdhhjenpgimjochcpelbijkich", // New York Times demo
"cgefhjmlaifaamhhoojmpcnihlbddeki", // Pandora demo
"kpjjigggmcjinapdeipapdcnmnjealll", // Pixlr demo
"ifnadhpngkodeccijnalokiabanejfgm", // Pixsta demo
"klcojgagjmpgmffcildkgbfmfffncpcd", // Plex demo
"nnikmgjhdlphciaonjmoppfckbpoinnb", // Pocket demo
"khldngaiohpnnoikfmnmfnebecgeobep", // Polarr Photo demo
"aleodiobpjillgfjdkblghiiaegggmcm", // Quickoffice demo
"nifkmgcdokhkjghdlgflonppnefddien", // Sheets demo
"hdmobeajeoanbanmdlabnbnlopepchip", // Slides demo
"dgohlccohkojjgkkfholmobjjoledflp", // Spotify demo
"dhmdaeekeihmajjnmichlhiffffdbpde", // Store.app demo
"onklhlmbpfnmgmelakhgehkfdmkpmekd", // Todoist demo
"jeabmjjifhfcejonjjhccaeigpnnjaak", // TweetDeck demo
"pdckcbpciaaicoomipamcabpdadhofgh", // Weatherbug demo
"biliocemfcghhioihldfdmkkhnofcgmb", // Webcam Toy demo
"bhfoghflalnnjfcfkaelngenjgjjhapk", // Wevideo demo
"pjckdjlmdcofkkkocnmhcbehkiapalho", // Wunderlist demo
"pbdihpaifchmclcmkfdgffnnpfbobefh", // YouTube demo
// Testing extensions:
"ongnjlefhnoajpbodoldndkbkdgfomlp", // Show Managed Storage
};
} // namespace
DeviceLocalAccountManagementPolicyProvider::
DeviceLocalAccountManagementPolicyProvider(
policy::DeviceLocalAccount::Type account_type)
: account_type_(account_type) {
}
DeviceLocalAccountManagementPolicyProvider::
~DeviceLocalAccountManagementPolicyProvider() {
}
std::string DeviceLocalAccountManagementPolicyProvider::
GetDebugPolicyProviderName() const {
#if defined(NDEBUG)
NOTREACHED();
return std::string();
#else
return "whitelist for device-local accounts";
#endif
}
bool DeviceLocalAccountManagementPolicyProvider::UserMayLoad(
const extensions::Extension* extension,
base::string16* error) const {
if (account_type_ == policy::DeviceLocalAccount::TYPE_PUBLIC_SESSION) {
// Allow extension if it is an externally hosted component of Chrome.
if (extension->location() ==
extensions::Manifest::EXTERNAL_COMPONENT) {
return true;
}
// Allow extension if its type is whitelisted for use in public sessions.
if (extension->GetType() == extensions::Manifest::TYPE_HOSTED_APP)
return true;
// Allow extension if its specific ID is whitelisted for use in public
// sessions.
for (size_t i = 0; i < arraysize(kPublicSessionWhitelist); ++i) {
if (extension->id() == kPublicSessionWhitelist[i])
return true;
}
} else if (account_type_ == policy::DeviceLocalAccount::TYPE_KIOSK_APP) {
// For single-app kiosk sessions, allow only platform apps.
if (extension->GetType() == extensions::Manifest::TYPE_PLATFORM_APP)
return true;
}
// Disallow all other extensions.
if (error) {
*error = l10n_util::GetStringFUTF16(
IDS_EXTENSION_CANT_INSTALL_IN_DEVICE_LOCAL_ACCOUNT,
base::UTF8ToUTF16(extension->name()),
base::UTF8ToUTF16(extension->id()));
}
return false;
}
} // namespace chromeos
|
