1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/ash/borealis/borealis_features.h"
#include <memory>
#include <string>
#include "ash/constants/ash_features.h"
#include "base/functional/callback.h"
#include "base/location.h"
#include "base/memory/raw_ptr.h"
#include "base/memory/weak_ptr.h"
#include "base/system/sys_info.h"
#include "base/task/task_traits.h"
#include "base/task/thread_pool.h"
#include "chrome/browser/ash/borealis/borealis_hardware_checker.h"
#include "chrome/browser/ash/borealis/borealis_prefs.h"
#include "chrome/browser/ash/guest_os/infra/cached_callback.h"
#include "chrome/browser/ash/profiles/profile_helper.h"
#include "chrome/browser/policy/profile_policy_connector.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/common/chrome_features.h"
#include "chromeos/ash/components/install_attributes/install_attributes.h"
#include "chromeos/ash/components/settings/cros_settings.h"
#include "chromeos/ash/components/settings/cros_settings_names.h"
#include "chromeos/ash/experiences/guest_os/virtual_machines/virtual_machines_util.h"
#include "components/prefs/pref_service.h"
#include "components/version_info/channel.h"
using AllowStatus = borealis::BorealisFeatures::AllowStatus;
namespace borealis {
class AsyncHardwareChecker
: public guest_os::CachedCallback<AllowStatus, bool> {
public:
AsyncHardwareChecker() = default;
private:
void Build(RealCallback callback) override {
// Testing hardware capabilities in unit tests is kindof pointless. The
// following check bypasses any attempt to do async checks unless we're
// running on a real CrOS device.
//
// Also do this first so we don't have to mock out statistics providers and
// other things in tests.
if (!base::SysInfo::IsRunningOnChromeOS()) {
std::move(callback).Run(Success(AllowStatus::kAllowed));
return;
}
// If the user has opted in to running on unsupported hardware then we don't
// need to actually check it.
if (base::FeatureList::IsEnabled(
ash::features::kBorealisEnableUnsupportedHardware)) {
std::move(callback).Run(Success(AllowStatus::kAllowed));
return;
}
HasSufficientHardware(base::BindOnce(
[](RealCallback callback, bool has_sufficient_hardware) {
// "Success" here means we successfully determined the
// status, which we can't really fail to do because any
// failure to determine something is treated as a
// disallowed status.
std::move(callback).Run(Success(
has_sufficient_hardware ? AllowStatus::kAllowed
: AllowStatus::kInsufficientHardware));
},
std::move(callback)));
}
};
BorealisFeatures::BorealisFeatures(Profile* profile)
: profile_(profile),
async_checker_(std::make_unique<AsyncHardwareChecker>()) {
// Issue a request for the status immediately upon creation, in case
// it's needed later.
IsAllowed(base::DoNothing());
}
BorealisFeatures::~BorealisFeatures() = default;
void BorealisFeatures::IsAllowed(
base::OnceCallback<void(AllowStatus)> callback) {
AllowStatus partial_status = PreHardwareChecks();
if (partial_status != AllowStatus::kAllowed) {
std::move(callback).Run(partial_status);
return;
}
async_checker_->Get(base::BindOnce(&BorealisFeatures::OnHardwareChecked,
weak_factory_.GetWeakPtr(),
std::move(callback)));
}
AllowStatus BorealisFeatures::PreHardwareChecks() {
// Only put failures here if the user has no means of changing them. I.e.
// failures here should be as set-in-stone as hardware.
if (!base::FeatureList::IsEnabled(features::kBorealis)) {
return AllowStatus::kFeatureDisabled;
}
return AllowStatus::kAllowed;
}
AllowStatus BorealisFeatures::PostHardwareChecks() {
// Failures here should be avoidable (in some sense) without users going and
// replacing their hardware.
if (!virtual_machines::AreVirtualMachinesAllowedByPolicy()) {
return AllowStatus::kVmPolicyBlocked;
}
if (!profile_ || !profile_->IsRegularProfile()) {
return AllowStatus::kBlockedOnIrregularProfile;
}
if (!ash::ProfileHelper::IsPrimaryProfile(profile_)) {
return AllowStatus::kBlockedOnNonPrimaryProfile;
}
if (profile_->IsChild()) {
return AllowStatus::kBlockedOnChildAccount;
}
const PrefService::Preference* user_allowed_pref =
profile_->GetPrefs()->FindPreference(prefs::kBorealisAllowedForUser);
if (!user_allowed_pref || !user_allowed_pref->GetValue()->GetBool()) {
return AllowStatus::kUserPrefBlocked;
}
// For managed users the preference must be explicitly set true. So we block
// in the case where the user is managed and the pref isn't.
//
// TODO(b/213398438): We migrated to using `default_for_enterprise_users` in
// crrev.com/c/4121754, which means we should remove the below code since an
// enterprise user will always have the policy set to its default (false).
if (!user_allowed_pref->IsManaged() &&
profile_->GetProfilePolicyConnector()->IsManaged()) {
return AllowStatus::kUserPrefBlocked;
}
if (!base::FeatureList::IsEnabled(ash::features::kBorealisPermitted)) {
return AllowStatus::kBlockedByFlag;
}
return AllowStatus::kAllowed;
}
void BorealisFeatures::OnHardwareChecked(
base::OnceCallback<void(AllowStatus)> callback,
AsyncHardwareChecker::Result hardware_status) {
if (!hardware_status.has_value()) {
std::move(callback).Run(AllowStatus::kFailedToDetermine);
return;
}
if (*hardware_status.value() != AllowStatus::kAllowed) {
std::move(callback).Run(*hardware_status.value());
return;
}
std::move(callback).Run(PostHardwareChecks());
}
bool BorealisFeatures::IsEnabled() {
return profile_->GetPrefs()->GetBoolean(prefs::kBorealisInstalledOnDevice);
}
} // namespace borealis
std::ostream& operator<<(std::ostream& os, const AllowStatus& reason) {
switch (reason) {
case AllowStatus::kAllowed:
return os << "Borealis is allowed";
case AllowStatus::kFeatureDisabled:
return os << "Borealis has not been released on this device";
case AllowStatus::kFailedToDetermine:
return os << "Could not verify that Borealis was allowed. Please Retry "
"in a bit";
case AllowStatus::kBlockedOnIrregularProfile:
return os << "Borealis is only available on normal login sessions";
case AllowStatus::kBlockedOnNonPrimaryProfile:
return os << "Borealis is only available on the primary profile";
case AllowStatus::kBlockedOnChildAccount:
return os << "Borealis is not available on child accounts";
case AllowStatus::kVmPolicyBlocked:
return os << "Your admin has blocked borealis (virtual machines are "
"disabled)";
case AllowStatus::kUserPrefBlocked:
return os << "Your admin has blocked borealis (for your account)";
case AllowStatus::kBlockedByFlag:
return os << "Borealis is still being worked on. You must set the "
"#borealis-enabled feature flag.";
case AllowStatus::kInsufficientHardware:
return os << "Borealis is not supported on this hardware";
}
}
|
