Bring back the domain gating check for settings protection.

This is effectively a revert of http://crrev.com/297947 while a better
long term solution is put together.

BUG=325447, 455647

Review URL: https://codereview.chromium.org/936483002

Cr-Commit-Position: refs/heads/master@{#316610}

6 files changed, 69 insertions, 6 deletions

diff --git a/chrome/browser/extensions/extension_startup_browsertest.cc b/chrome/browser/extensions/extension_startup_browsertest.cc
index f8040d9..d61a48d2 100644
--- a/chrome/browser/extensions/extension_startup_browsertest.cc
+++ b/chrome/browser/extensions/extension_startup_browsertest.cc
@@ -97,6 +97,14 @@ class ExtensionStartupTestBase : public InProcessBrowserTest {
     return true;
   }
 
+  void SetUpInProcessBrowserTestFixture() override {
+    InProcessBrowserTest::SetUpInProcessBrowserTestFixture();
+
+    // Bots are on a domain, turn off the domain check for settings hardening in
+    // order to be able to test all SettingsEnforcement groups.
+    chrome_prefs::DisableDomainCheckForTesting();
+  }
+
   void TearDown() override {
     EXPECT_TRUE(base::DeleteFile(preferences_file_, false));
 
diff --git a/chrome/browser/first_run/first_run_browsertest.cc b/chrome/browser/first_run/first_run_browsertest.cc
index 5f06a12..0c97f4c 100644
--- a/chrome/browser/first_run/first_run_browsertest.cc
+++ b/chrome/browser/first_run/first_run_browsertest.cc
@@ -6,6 +6,7 @@
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
+#include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/string_util.h"
@@ -248,6 +249,9 @@ class FirstRunMasterPrefsWithTrackedPreferences
     : public FirstRunMasterPrefsBrowserTestT<kWithTrackedPrefs>,
       public testing::WithParamInterface<std::string> {
  public:
+  FirstRunMasterPrefsWithTrackedPreferences() {}
+
+ protected:
   void SetUpCommandLine(base::CommandLine* command_line) override {
     FirstRunMasterPrefsBrowserTestT::SetUpCommandLine(command_line);
     command_line->AppendSwitchASCII(
@@ -255,6 +259,17 @@ class FirstRunMasterPrefsWithTrackedPreferences
         std::string(chrome_prefs::internals::kSettingsEnforcementTrialName) +
             "/" + GetParam() + "/");
   }
+
+  void SetUpInProcessBrowserTestFixture() override {
+    FirstRunMasterPrefsBrowserTestT::SetUpInProcessBrowserTestFixture();
+
+    // Bots are on a domain, turn off the domain check for settings hardening in
+    // order to be able to test all SettingsEnforcement groups.
+    chrome_prefs::DisableDomainCheckForTesting();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FirstRunMasterPrefsWithTrackedPreferences);
 };
 
 // http://crbug.com/314221
diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browser/prefs/chrome_pref_service_factory.cc
index 26effe1..0deb832 100644
--- a/chrome/browser/prefs/chrome_pref_service_factory.cc
+++ b/chrome/browser/prefs/chrome_pref_service_factory.cc
@@ -65,15 +65,25 @@
 #include "chrome/browser/supervised_user/supervised_user_pref_store.h"
 #endif
 
-#if defined(OS_WIN) && defined(ENABLE_RLZ)
+#if defined(OS_WIN)
+#include "base/win/win_util.h"
+#if defined(ENABLE_RLZ)
 #include "rlz/lib/machine_id.h"
-#endif  // defined(ENABLE_RLZ) && defined(OS_WIN)
+#endif  // defined(ENABLE_RLZ)
+#endif  // defined(OS_WIN)
 
 using content::BrowserContext;
 using content::BrowserThread;
 
 namespace {
 
+#if defined(OS_WIN)
+// Whether we are in testing mode; can be enabled via
+// DisableDomainCheckForTesting(). Forces startup checks to ignore the presence
+// of a domain when determining the active SettingsEnforcement group.
+bool g_disable_domain_check_for_testing = false;
+#endif  // OS_WIN
+
 // These preferences must be kept in sync with the TrackedPreference enum in
 // tools/metrics/histograms/histograms.xml. To add a new preference, append it
 // to the array and add a corresponding value to the histogram enum. Each
@@ -248,6 +258,20 @@ enum SettingsEnforcementGroup {
 };
 
 SettingsEnforcementGroup GetSettingsEnforcementGroup() {
+# if defined(OS_WIN)
+  if (!g_disable_domain_check_for_testing) {
+    static bool first_call = true;
+    static const bool is_enrolled_to_domain = base::win::IsEnrolledToDomain();
+    if (first_call) {
+      UMA_HISTOGRAM_BOOLEAN("Settings.TrackedPreferencesNoEnforcementOnDomain",
+                            is_enrolled_to_domain);
+      first_call = false;
+    }
+    if (is_enrolled_to_domain)
+      return GROUP_NO_ENFORCEMENT;
+  }
+#endif
+
   struct {
     const char* group_name;
     SettingsEnforcementGroup group;
@@ -521,6 +545,12 @@ void SchedulePrefsFilePathVerification(const base::FilePath& profile_path) {
 #endif
 }
 
+void DisableDomainCheckForTesting() {
+#if defined(OS_WIN)
+  g_disable_domain_check_for_testing = true;
+#endif  // OS_WIN
+}
+
 bool InitializePrefsFromMasterPrefs(
     const base::FilePath& profile_path,
     const base::DictionaryValue& master_prefs) {
diff --git a/chrome/browser/prefs/chrome_pref_service_factory.h b/chrome/browser/prefs/chrome_pref_service_factory.h
index 06c49d5..425aef4 100644
--- a/chrome/browser/prefs/chrome_pref_service_factory.h
+++ b/chrome/browser/prefs/chrome_pref_service_factory.h
@@ -81,6 +81,10 @@ scoped_ptr<PrefServiceSyncable> CreateProfilePrefs(
 // |profile_path|.
 void SchedulePrefsFilePathVerification(const base::FilePath& profile_path);
 
+// Call before startup tasks kick in to ignore the presence of a domain when
+// determining the active SettingsEnforcement group. For testing only.
+void DisableDomainCheckForTesting();
+
 // Initializes the preferences for the profile at |profile_path| with the
 // preference values in |master_prefs|. Returns true on success.
 bool InitializePrefsFromMasterPrefs(
diff --git a/chrome/browser/prefs/tracked/pref_hash_browsertest.cc b/chrome/browser/prefs/tracked/pref_hash_browsertest.cc
index 8fdef23..5a8e5ce 100644
--- a/chrome/browser/prefs/tracked/pref_hash_browsertest.cc
+++ b/chrome/browser/prefs/tracked/pref_hash_browsertest.cc
@@ -228,6 +228,14 @@ class PrefHashBrowserTestBase
     return true;
   }
 
+  void SetUpInProcessBrowserTestFixture() override {
+    ExtensionBrowserTest::SetUpInProcessBrowserTestFixture();
+
+    // Bots are on a domain, turn off the domain check for settings hardening in
+    // order to be able to test all SettingsEnforcement groups.
+    chrome_prefs::DisableDomainCheckForTesting();
+  }
+
   // In the PRE_ test, find the number of tracked preferences that were
   // initialized and save it to a file to be read back in the main test and used
   // as the total number of tracked preferences.
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 5694e42..d4fa228 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -33438,13 +33438,11 @@ Therefore, the affected-histogram name has to have at least one dot in it.
 
 <histogram name="Settings.TrackedPreferencesNoEnforcementOnDomain"
     enum="BooleanEnabled">
-  <obsolete>
-    Deprecated 2014-10.
-  </obsolete>
   <owner>gab@chromium.org</owner>
   <summary>
     Whether settings enforcement was cancelled for a machine joined to a domain.
-    Reported once per session on browser startup.
+    Reported once per session on browser startup (note: this histogram was
+    disabled for part of M40).
   </summary>
 </histogram>