1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
// Copyright (c) 2011 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "remoting/host/plugin/policy_hack/nat_policy.h"
#include <CoreFoundation/CoreFoundation.h>
#include "base/compiler_specific.h"
#include "base/mac/scoped_cftyperef.h"
#include "base/message_loop_proxy.h"
#include "base/scoped_ptr.h"
#include "base/sys_string_conversions.h"
#include "base/values.h"
namespace {
struct BundledAppPolicy {
Boolean is_valid;
Boolean is_allowed;
CFStringRef bundle_id;
};
}
namespace remoting {
namespace policy_hack {
// The MacOS version does not watch files (because there is potentially 9
// files to watch in three different locations) and because it is accepted
// practice on the Mac that the user must logout/login for policies to be
// applied. This will actually pick up policies every
// |kFallbackReloadDelayMinutes| which is sufficient for right now.
class NatPolicyMac : public NatPolicy {
public:
explicit NatPolicyMac(base::MessageLoopProxy* message_loop_proxy)
: NatPolicy(message_loop_proxy) {
}
virtual ~NatPolicyMac() {
}
protected:
virtual void StartWatchingInternal() OVERRIDE {
Reload();
}
virtual void StopWatchingInternal() OVERRIDE {
}
virtual void Reload() OVERRIDE {
DCHECK(OnPolicyThread());
// Since policy could be set for any of these browsers, assume the most
// restrictive.
BundledAppPolicy policies[3] = {
{ false, true, CFSTR("com.google.Chrome") },
{ false, true, CFSTR("com.chromium.Chromium") },
{ false, true, CFSTR("com.google.Chrome.canary") }
};
base::DictionaryValue policy;
base::mac::ScopedCFTypeRef<CFStringRef> policy_key(
base::SysUTF8ToCFStringRef(kNatPolicyName));
bool is_allowed = true;
bool is_valid = false;
CFStringRef bundle_setting_policy = NULL;
for (size_t i = 0; i < arraysize(policies); ++i) {
if (CFPreferencesAppSynchronize(policies[i].bundle_id)) {
policies[i].is_allowed = CFPreferencesGetAppBooleanValue(
policy_key,
policies[i].bundle_id,
&policies[i].is_valid);
if (policies[i].is_valid) {
is_allowed &= policies[i].is_allowed;
if (!is_allowed && bundle_setting_policy == NULL) {
bundle_setting_policy = policies[i].bundle_id;
}
is_valid = true;
}
}
}
// Only set policy if a valid policy was found.
if (is_valid) {
policy.SetBoolean(kNatPolicyName, is_allowed);
// Log if there is policy conflict.
for (size_t i = 0; i < arraysize(policies); ++i) {
if (policies[i].is_valid && policies[i].is_allowed != is_allowed) {
LOG(WARNING) << base::SysCFStringRefToUTF8(policies[i].bundle_id)
<< ":" << kNatPolicyName
<< "(" << (policies[i].is_allowed ? "true" : "false")
<< ") is being overridden by "
<< base::SysCFStringRefToUTF8(bundle_setting_policy)
<< ":" << kNatPolicyName
<< "(" << (is_allowed ? "true" : "false") << ")";
}
}
}
// Set policy. Policy must be set (even if it is empty) so that the
// default policy is picked up the first time reload is called.
UpdateNatPolicy(&policy);
// Reschedule task.
ScheduleFallbackReloadTask();
}
};
NatPolicy* NatPolicy::Create(base::MessageLoopProxy* message_loop_proxy) {
return new NatPolicyMac(message_loop_proxy);
}
} // namespace policy_hack
} // namespace remoting
|
