1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
// Copyright 2013 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/policy/networking/policy_cert_service_factory.h"
#include "base/containers/contains.h"
#include "base/no_destructor.h"
#include "build/build_config.h"
#include "chrome/browser/ash/policy/core/browser_policy_connector_ash.h"
#include "chrome/browser/ash/profiles/profile_helper.h"
#include "chrome/browser/browser_process.h"
#include "chrome/browser/browser_process_platform_part.h"
#include "chrome/browser/policy/networking/device_network_configuration_updater_ash.h"
#include "chrome/browser/policy/networking/policy_cert_service.h"
#include "chrome/browser/policy/networking/user_network_configuration_updater.h"
#include "chrome/browser/policy/networking/user_network_configuration_updater_factory.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/profiles/profile_manager.h"
#include "chrome/common/pref_names.h"
#include "components/prefs/scoped_user_pref_update.h"
#include "components/user_manager/user_manager.h"
static_assert(BUILDFLAG(IS_CHROMEOS));
namespace policy {
namespace {
// Returns the PolicyCertificateProvider that should be used for |profile|.
// May return nullptr, which should be treated as no policy-provided
// certificates set.
ash::PolicyCertificateProvider* GetPolicyCertificateProvider(Profile* profile) {
if (ash::ProfileHelper::Get()->IsSigninProfile(profile)) {
return g_browser_process->platform_part()
->browser_policy_connector_ash()
->GetDeviceNetworkConfigurationUpdater();
}
// The lock screen profile has access to the policy provided CA certs from the
// primary profile.
if (ash::ProfileHelper::Get()->IsLockScreenProfile(profile)) {
return UserNetworkConfigurationUpdaterFactory::GetForBrowserContext(
ProfileManager::GetPrimaryUserProfile());
}
return UserNetworkConfigurationUpdaterFactory::GetForBrowserContext(profile);
}
std::unique_ptr<KeyedService> BuildServiceInstanceAsh(
content::BrowserContext* context) {
Profile* profile = Profile::FromBrowserContext(context);
ash::PolicyCertificateProvider* policy_certificate_provider =
GetPolicyCertificateProvider(profile);
if (!policy_certificate_provider) {
return nullptr;
}
if (ash::ProfileHelper::Get()->IsSigninProfile(profile)) {
return std::make_unique<PolicyCertService>(
profile, policy_certificate_provider,
/*may_use_profile_wide_trust_anchors=*/false);
}
if (ash::ProfileHelper::Get()->IsLockScreenProfile(profile)) {
return std::make_unique<PolicyCertService>(
profile, policy_certificate_provider,
/*may_use_profile_wide_trust_anchors=*/true);
}
// Don't allow policy-provided certificates for "special" Profiles except the
// one listed above.
user_manager::UserManager* user_manager = user_manager::UserManager::Get();
const user_manager::User* user = ash::ProfileHelper::Get()->GetUserByProfile(
profile->GetOriginalProfile());
if (!user) {
return nullptr;
}
// Only allow trusted policy-provided certificates for non-guest primary
// users. Guest users don't have user policy, but set
// `may_use_profile_wide_trust_anchors`=false for them out of caution against
// future changes.
bool may_use_profile_wide_trust_anchors =
user == user_manager->GetPrimaryUser() &&
user->GetType() != user_manager::UserType::kGuest;
return std::make_unique<PolicyCertService>(
profile, policy_certificate_provider, may_use_profile_wide_trust_anchors);
}
} // namespace
// static
PolicyCertService* PolicyCertServiceFactory::GetForProfile(Profile* profile) {
return static_cast<PolicyCertService*>(
GetInstance()->GetServiceForBrowserContext(profile, true));
}
// static
PolicyCertServiceFactory* PolicyCertServiceFactory::GetInstance() {
static base::NoDestructor<PolicyCertServiceFactory> instance;
return instance.get();
}
PolicyCertServiceFactory::PolicyCertServiceFactory()
: ProfileKeyedServiceFactory(
"PolicyCertService",
ProfileSelections::Builder()
.WithRegular(ProfileSelection::kOwnInstance)
// TODO(crbug.com/40257657): Check if this service is needed in
// Guest mode.
.WithGuest(ProfileSelection::kOwnInstance)
// TODO(crbug.com/41488885): Check if this service is needed for
// Ash Internals.
.WithAshInternals(ProfileSelection::kOwnInstance)
.Build()) {
DependsOn(UserNetworkConfigurationUpdaterFactory::GetInstance());
}
PolicyCertServiceFactory::~PolicyCertServiceFactory() = default;
std::unique_ptr<KeyedService>
PolicyCertServiceFactory::BuildServiceInstanceForBrowserContext(
content::BrowserContext* context) const {
return BuildServiceInstanceAsh(context);
}
bool PolicyCertServiceFactory::ServiceIsNULLWhileTesting() const {
return true;
}
} // namespace policy
|
