device_policy_decoder_chromeos.cc revision bb1529ce867d8845a77ec7cdf3e3003ef1771a40 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/policy/device_policy_decoder_chromeos.h"
6
7#include <limits>
8
9#include "base/callback.h"
10#include "base/logging.h"
11#include "base/values.h"
12#include "chrome/browser/chromeos/policy/device_local_account.h"
13#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
14#include "chrome/browser/chromeos/settings/cros_settings_names.h"
15#include "chrome/browser/policy/external_data_fetcher.h"
16#include "chrome/browser/policy/policy_map.h"
17#include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h"
18#include "chromeos/dbus/dbus_thread_manager.h"
19#include "chromeos/dbus/update_engine_client.h"
20#include "policy/policy_constants.h"
21#include "third_party/cros_system_api/dbus/service_constants.h"
22
23using google::protobuf::RepeatedField;
24using google::protobuf::RepeatedPtrField;
25
26namespace em = enterprise_management;
27
28namespace policy {
29
30namespace {
31
32// Decodes a protobuf integer to an IntegerValue. The caller assumes ownership
33// of the return Value*. Returns NULL in case the input value is out of bounds.
34Value* DecodeIntegerValue(google::protobuf::int64 value) {
35  if (value < std::numeric_limits<int>::min() ||
36      value > std::numeric_limits<int>::max()) {
37    LOG(WARNING) << "Integer value " << value
38                 << " out of numeric limits, ignoring.";
39    return NULL;
40  }
41
42  return Value::CreateIntegerValue(static_cast<int>(value));
43}
44
45Value* DecodeConnectionType(int value) {
46  static const char* const kConnectionTypes[] = {
47    flimflam::kTypeEthernet,
48    flimflam::kTypeWifi,
49    flimflam::kTypeWimax,
50    flimflam::kTypeBluetooth,
51    flimflam::kTypeCellular,
52  };
53
54  if (value < 0 || value >= static_cast<int>(arraysize(kConnectionTypes)))
55    return NULL;
56
57  return Value::CreateStringValue(kConnectionTypes[value]);
58}
59
60void DecodeLoginPolicies(const em::ChromeDeviceSettingsProto& policy,
61                         PolicyMap* policies) {
62  if (policy.has_guest_mode_enabled()) {
63    const em::GuestModeEnabledProto& container(policy.guest_mode_enabled());
64    if (container.has_guest_mode_enabled()) {
65      policies->Set(key::kDeviceGuestModeEnabled,
66                    POLICY_LEVEL_MANDATORY,
67                    POLICY_SCOPE_MACHINE,
68                    Value::CreateBooleanValue(container.guest_mode_enabled()),
69                    NULL);
70    }
71  }
72
73  if (policy.has_show_user_names()) {
74    const em::ShowUserNamesOnSigninProto& container(policy.show_user_names());
75    if (container.has_show_user_names()) {
76      policies->Set(key::kDeviceShowUserNamesOnSignin,
77                    POLICY_LEVEL_MANDATORY,
78                    POLICY_SCOPE_MACHINE,
79                    Value::CreateBooleanValue(container.show_user_names()),
80                    NULL);
81    }
82  }
83
84  if (policy.has_allow_new_users()) {
85    const em::AllowNewUsersProto& container(policy.allow_new_users());
86    if (container.has_allow_new_users()) {
87      policies->Set(key::kDeviceAllowNewUsers,
88                    POLICY_LEVEL_MANDATORY,
89                    POLICY_SCOPE_MACHINE,
90                    Value::CreateBooleanValue(container.allow_new_users()),
91                    NULL);
92    }
93  }
94
95  if (policy.has_user_whitelist()) {
96    const em::UserWhitelistProto& container(policy.user_whitelist());
97    ListValue* whitelist = new ListValue();
98    RepeatedPtrField<std::string>::const_iterator entry;
99    for (entry = container.user_whitelist().begin();
100         entry != container.user_whitelist().end();
101         ++entry) {
102      whitelist->Append(Value::CreateStringValue(*entry));
103    }
104    policies->Set(key::kDeviceUserWhitelist,
105                  POLICY_LEVEL_MANDATORY,
106                  POLICY_SCOPE_MACHINE,
107                  whitelist,
108                  NULL);
109  }
110
111  if (policy.has_ephemeral_users_enabled()) {
112    const em::EphemeralUsersEnabledProto& container(
113        policy.ephemeral_users_enabled());
114    if (container.has_ephemeral_users_enabled()) {
115      policies->Set(key::kDeviceEphemeralUsersEnabled,
116                    POLICY_LEVEL_MANDATORY,
117                    POLICY_SCOPE_MACHINE,
118                    Value::CreateBooleanValue(
119                        container.ephemeral_users_enabled()),
120                    NULL);
121    }
122  }
123
124  if (policy.has_device_local_accounts()) {
125    const em::DeviceLocalAccountsProto& container(
126        policy.device_local_accounts());
127    const RepeatedPtrField<em::DeviceLocalAccountInfoProto>& accounts =
128        container.account();
129    scoped_ptr<base::ListValue> account_list(new base::ListValue());
130    RepeatedPtrField<em::DeviceLocalAccountInfoProto>::const_iterator entry;
131    for (entry = accounts.begin(); entry != accounts.end(); ++entry) {
132      scoped_ptr<base::DictionaryValue> entry_dict(
133          new base::DictionaryValue());
134      if (entry->has_type()) {
135        if (entry->has_account_id()) {
136          entry_dict->SetStringWithoutPathExpansion(
137              chromeos::kAccountsPrefDeviceLocalAccountsKeyId,
138              entry->account_id());
139        }
140        entry_dict->SetIntegerWithoutPathExpansion(
141            chromeos::kAccountsPrefDeviceLocalAccountsKeyType, entry->type());
142        if (entry->kiosk_app().has_app_id()) {
143          entry_dict->SetStringWithoutPathExpansion(
144              chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppId,
145              entry->kiosk_app().app_id());
146        }
147        if (entry->kiosk_app().has_update_url()) {
148          entry_dict->SetStringWithoutPathExpansion(
149              chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL,
150              entry->kiosk_app().update_url());
151        }
152      } else if (entry->has_deprecated_public_session_id()) {
153        // Deprecated public session specification.
154        entry_dict->SetStringWithoutPathExpansion(
155            chromeos::kAccountsPrefDeviceLocalAccountsKeyId,
156            entry->deprecated_public_session_id());
157        entry_dict->SetIntegerWithoutPathExpansion(
158            chromeos::kAccountsPrefDeviceLocalAccountsKeyType,
159            DeviceLocalAccount::TYPE_PUBLIC_SESSION);
160      }
161      account_list->Append(entry_dict.release());
162    }
163    policies->Set(key::kDeviceLocalAccounts,
164                  POLICY_LEVEL_MANDATORY,
165                  POLICY_SCOPE_MACHINE,
166                  account_list.release(),
167                  NULL);
168    if (container.has_auto_login_id()) {
169      policies->Set(key::kDeviceLocalAccountAutoLoginId,
170                    POLICY_LEVEL_MANDATORY,
171                    POLICY_SCOPE_MACHINE,
172                    Value::CreateStringValue(container.auto_login_id()),
173                    NULL);
174    }
175    if (container.has_auto_login_delay()) {
176      policies->Set(key::kDeviceLocalAccountAutoLoginDelay,
177                    POLICY_LEVEL_MANDATORY,
178                    POLICY_SCOPE_MACHINE,
179                    DecodeIntegerValue(container.auto_login_delay()),
180                    NULL);
181    }
182    if (container.has_enable_auto_login_bailout()) {
183      policies->Set(key::kDeviceLocalAccountAutoLoginBailoutEnabled,
184                    POLICY_LEVEL_MANDATORY,
185                    POLICY_SCOPE_MACHINE,
186                    Value::CreateBooleanValue(
187                        container.enable_auto_login_bailout()),
188                    NULL);
189    }
190  }
191
192  if (policy.has_supervised_users_settings()) {
193    const em::SupervisedUsersSettingsProto& container =
194        policy.supervised_users_settings();
195    if (container.has_supervised_users_enabled()) {
196      Value* value = Value::CreateBooleanValue(
197          container.supervised_users_enabled());
198      policies->Set(key::kSupervisedUsersEnabled,
199                    POLICY_LEVEL_MANDATORY,
200                    POLICY_SCOPE_MACHINE,
201                    value,
202                    NULL);
203    }
204  }
205}
206
207void DecodeKioskPolicies(const em::ChromeDeviceSettingsProto& policy,
208                         PolicyMap* policies,
209                         EnterpriseInstallAttributes* install_attributes) {
210  // No policies if this is not KIOSK.
211  if (install_attributes->GetMode() != DEVICE_MODE_RETAIL_KIOSK)
212    return;
213
214  if (policy.has_forced_logout_timeouts()) {
215    const em::ForcedLogoutTimeoutsProto& container(
216        policy.forced_logout_timeouts());
217    if (container.has_idle_logout_timeout()) {
218      policies->Set(key::kDeviceIdleLogoutTimeout,
219                    POLICY_LEVEL_MANDATORY,
220                    POLICY_SCOPE_MACHINE,
221                    DecodeIntegerValue(container.idle_logout_timeout()),
222                    NULL);
223    }
224    if (container.has_idle_logout_warning_duration()) {
225      policies->Set(key::kDeviceIdleLogoutWarningDuration,
226                    POLICY_LEVEL_MANDATORY,
227                    POLICY_SCOPE_MACHINE,
228                    DecodeIntegerValue(
229                        container.idle_logout_warning_duration()),
230                    NULL);
231    }
232  }
233
234  if (policy.has_login_screen_saver()) {
235    const em::ScreenSaverProto& container(
236        policy.login_screen_saver());
237    if (container.has_screen_saver_extension_id()) {
238      policies->Set(key::kDeviceLoginScreenSaverId,
239                    POLICY_LEVEL_MANDATORY,
240                    POLICY_SCOPE_MACHINE,
241                    Value::CreateStringValue(
242                        container.screen_saver_extension_id()),
243                    NULL);
244    }
245    if (container.has_screen_saver_timeout()) {
246      policies->Set(key::kDeviceLoginScreenSaverTimeout,
247                    POLICY_LEVEL_MANDATORY,
248                    POLICY_SCOPE_MACHINE,
249                    DecodeIntegerValue(container.screen_saver_timeout()),
250                    NULL);
251    }
252  }
253
254  if (policy.has_app_pack()) {
255    const em::AppPackProto& container(policy.app_pack());
256    base::ListValue* app_pack_list = new base::ListValue();
257    for (int i = 0; i < container.app_pack_size(); ++i) {
258      const em::AppPackEntryProto& entry(container.app_pack(i));
259      if (entry.has_extension_id() && entry.has_update_url()) {
260        base::DictionaryValue* dict = new base::DictionaryValue();
261        dict->SetString(chromeos::kAppPackKeyExtensionId, entry.extension_id());
262        dict->SetString(chromeos::kAppPackKeyUpdateUrl, entry.update_url());
263        app_pack_list->Append(dict);
264      }
265    }
266    policies->Set(key::kDeviceAppPack,
267                  POLICY_LEVEL_MANDATORY,
268                  POLICY_SCOPE_MACHINE,
269                  app_pack_list,
270                  NULL);
271  }
272
273  if (policy.has_pinned_apps()) {
274    const em::PinnedAppsProto& container(policy.pinned_apps());
275    base::ListValue* pinned_apps_list = new base::ListValue();
276    for (int i = 0; i < container.app_id_size(); ++i)
277      pinned_apps_list->Append(Value::CreateStringValue(container.app_id(i)));
278
279    policies->Set(key::kPinnedLauncherApps,
280                  POLICY_LEVEL_RECOMMENDED,
281                  POLICY_SCOPE_MACHINE,
282                  pinned_apps_list,
283                  NULL);
284  }
285}
286
287void DecodeNetworkPolicies(const em::ChromeDeviceSettingsProto& policy,
288                           PolicyMap* policies,
289                           EnterpriseInstallAttributes* install_attributes) {
290  if (policy.has_device_proxy_settings()) {
291    const em::DeviceProxySettingsProto& container(
292        policy.device_proxy_settings());
293    scoped_ptr<DictionaryValue> proxy_settings(new DictionaryValue);
294    if (container.has_proxy_mode())
295      proxy_settings->SetString(key::kProxyMode, container.proxy_mode());
296    if (container.has_proxy_server())
297      proxy_settings->SetString(key::kProxyServer, container.proxy_server());
298    if (container.has_proxy_pac_url())
299      proxy_settings->SetString(key::kProxyPacUrl, container.proxy_pac_url());
300    if (container.has_proxy_bypass_list()) {
301      proxy_settings->SetString(key::kProxyBypassList,
302                                container.proxy_bypass_list());
303    }
304
305    // Figure out the level. Proxy policy is mandatory in kiosk mode.
306    PolicyLevel level = POLICY_LEVEL_RECOMMENDED;
307    if (install_attributes->GetMode() == DEVICE_MODE_RETAIL_KIOSK)
308      level = POLICY_LEVEL_MANDATORY;
309
310    if (!proxy_settings->empty()) {
311      policies->Set(key::kProxySettings,
312                    level,
313                    POLICY_SCOPE_MACHINE,
314                    proxy_settings.release(),
315                    NULL);
316    }
317  }
318
319  if (policy.has_data_roaming_enabled()) {
320    const em::DataRoamingEnabledProto& container(policy.data_roaming_enabled());
321    if (container.has_data_roaming_enabled()) {
322      policies->Set(key::kDeviceDataRoamingEnabled,
323                    POLICY_LEVEL_MANDATORY,
324                    POLICY_SCOPE_MACHINE,
325                    Value::CreateBooleanValue(
326                        container.data_roaming_enabled()),
327                    NULL);
328    }
329  }
330
331  if (policy.has_open_network_configuration() &&
332      policy.open_network_configuration().has_open_network_configuration()) {
333    std::string config(
334        policy.open_network_configuration().open_network_configuration());
335    policies->Set(key::kDeviceOpenNetworkConfiguration,
336                  POLICY_LEVEL_MANDATORY,
337                  POLICY_SCOPE_MACHINE,
338                  Value::CreateStringValue(config),
339                  NULL);
340  }
341}
342
343void DecodeReportingPolicies(const em::ChromeDeviceSettingsProto& policy,
344                             PolicyMap* policies) {
345  if (policy.has_device_reporting()) {
346    const em::DeviceReportingProto& container(policy.device_reporting());
347    if (container.has_report_version_info()) {
348      policies->Set(key::kReportDeviceVersionInfo,
349                    POLICY_LEVEL_MANDATORY,
350                    POLICY_SCOPE_MACHINE,
351                    Value::CreateBooleanValue(container.report_version_info()),
352                    NULL);
353    }
354    if (container.has_report_activity_times()) {
355      policies->Set(key::kReportDeviceActivityTimes,
356                    POLICY_LEVEL_MANDATORY,
357                    POLICY_SCOPE_MACHINE,
358                    Value::CreateBooleanValue(
359                        container.report_activity_times()),
360                    NULL);
361    }
362    if (container.has_report_boot_mode()) {
363      policies->Set(key::kReportDeviceBootMode,
364                    POLICY_LEVEL_MANDATORY,
365                    POLICY_SCOPE_MACHINE,
366                    Value::CreateBooleanValue(container.report_boot_mode()),
367                    NULL);
368    }
369    if (container.has_report_location()) {
370      policies->Set(key::kReportDeviceLocation,
371                    POLICY_LEVEL_MANDATORY,
372                    POLICY_SCOPE_MACHINE,
373                    Value::CreateBooleanValue(container.report_location()),
374                    NULL);
375    }
376    if (container.has_report_network_interfaces()) {
377      policies->Set(key::kReportDeviceNetworkInterfaces,
378                    POLICY_LEVEL_MANDATORY,
379                    POLICY_SCOPE_MACHINE,
380                    Value::CreateBooleanValue(
381                        container.report_network_interfaces()),
382                    NULL);
383    }
384  }
385}
386
387void DecodeAutoUpdatePolicies(const em::ChromeDeviceSettingsProto& policy,
388                              PolicyMap* policies) {
389  if (policy.has_release_channel()) {
390    const em::ReleaseChannelProto& container(policy.release_channel());
391    if (container.has_release_channel()) {
392      std::string channel(container.release_channel());
393      policies->Set(key::kChromeOsReleaseChannel,
394                    POLICY_LEVEL_MANDATORY,
395                    POLICY_SCOPE_MACHINE,
396                    Value::CreateStringValue(channel),
397                    NULL);
398      // TODO(dubroy): Once http://crosbug.com/17015 is implemented, we won't
399      // have to pass the channel in here, only ping the update engine to tell
400      // it to fetch the channel from the policy.
401      chromeos::DBusThreadManager::Get()->GetUpdateEngineClient()->
402          SetChannel(channel, false);
403    }
404    if (container.has_release_channel_delegated()) {
405      policies->Set(key::kChromeOsReleaseChannelDelegated,
406                    POLICY_LEVEL_MANDATORY,
407                    POLICY_SCOPE_MACHINE,
408                    Value::CreateBooleanValue(
409                        container.release_channel_delegated()),
410                    NULL);
411    }
412  }
413
414  if (policy.has_auto_update_settings()) {
415    const em::AutoUpdateSettingsProto& container(policy.auto_update_settings());
416    if (container.has_update_disabled()) {
417      policies->Set(key::kDeviceAutoUpdateDisabled,
418                    POLICY_LEVEL_MANDATORY,
419                    POLICY_SCOPE_MACHINE,
420                    Value::CreateBooleanValue(container.update_disabled()),
421                    NULL);
422    }
423
424    if (container.has_target_version_prefix()) {
425      policies->Set(key::kDeviceTargetVersionPrefix,
426                    POLICY_LEVEL_MANDATORY,
427                    POLICY_SCOPE_MACHINE,
428                    Value::CreateStringValue(
429                        container.target_version_prefix()),
430                    NULL);
431    }
432
433    // target_version_display_name is not actually a policy, but a display
434    // string for target_version_prefix, so we ignore it.
435
436    if (container.has_scatter_factor_in_seconds()) {
437      policies->Set(key::kDeviceUpdateScatterFactor,
438                    POLICY_LEVEL_MANDATORY,
439                    POLICY_SCOPE_MACHINE,
440                    Value::CreateIntegerValue(
441                        container.scatter_factor_in_seconds()),
442                    NULL);
443    }
444
445    if (container.allowed_connection_types_size()) {
446      ListValue* allowed_connection_types = new ListValue();
447      RepeatedField<int>::const_iterator entry;
448      for (entry = container.allowed_connection_types().begin();
449           entry != container.allowed_connection_types().end();
450           ++entry) {
451        base::Value* value = DecodeConnectionType(*entry);
452        if (value)
453          allowed_connection_types->Append(value);
454      }
455      policies->Set(key::kDeviceUpdateAllowedConnectionTypes,
456                    POLICY_LEVEL_MANDATORY,
457                    POLICY_SCOPE_MACHINE,
458                    allowed_connection_types,
459                    NULL);
460    }
461
462    if (container.has_reboot_after_update()) {
463      policies->Set(key::kRebootAfterUpdate,
464                    POLICY_LEVEL_MANDATORY,
465                    POLICY_SCOPE_MACHINE,
466                    Value::CreateBooleanValue(container.reboot_after_update()),
467                    NULL);
468    }
469  }
470}
471
472void DecodeAccessibilityPolicies(const em::ChromeDeviceSettingsProto& policy,
473                                 PolicyMap* policies) {
474  if (policy.has_accessibility_settings()) {
475    const em::AccessibilitySettingsProto&
476        container(policy.accessibility_settings());
477
478    if (container.has_login_screen_default_large_cursor_enabled()) {
479      policies->Set(
480          key::kDeviceLoginScreenDefaultLargeCursorEnabled,
481          POLICY_LEVEL_MANDATORY,
482          POLICY_SCOPE_MACHINE,
483          Value::CreateBooleanValue(
484              container.login_screen_default_large_cursor_enabled()),
485          NULL);
486    }
487
488    if (container.has_login_screen_default_spoken_feedback_enabled()) {
489      policies->Set(
490          key::kDeviceLoginScreenDefaultSpokenFeedbackEnabled,
491          POLICY_LEVEL_MANDATORY,
492          POLICY_SCOPE_MACHINE,
493          Value::CreateBooleanValue(
494              container.login_screen_default_spoken_feedback_enabled()),
495          NULL);
496    }
497
498    if (container.has_login_screen_default_high_contrast_enabled()) {
499      policies->Set(
500          key::kDeviceLoginScreenDefaultHighContrastEnabled,
501          POLICY_LEVEL_MANDATORY,
502          POLICY_SCOPE_MACHINE,
503          Value::CreateBooleanValue(
504              container.login_screen_default_high_contrast_enabled()),
505          NULL);
506    }
507
508    if (container.has_login_screen_default_screen_magnifier_type()) {
509      policies->Set(
510          key::kDeviceLoginScreenDefaultScreenMagnifierType,
511          POLICY_LEVEL_MANDATORY,
512          POLICY_SCOPE_MACHINE,
513          DecodeIntegerValue(
514              container.login_screen_default_screen_magnifier_type()),
515          NULL);
516    }
517  }
518}
519
520void DecodeGenericPolicies(const em::ChromeDeviceSettingsProto& policy,
521                           PolicyMap* policies) {
522  if (policy.has_device_policy_refresh_rate()) {
523    const em::DevicePolicyRefreshRateProto& container(
524        policy.device_policy_refresh_rate());
525    if (container.has_device_policy_refresh_rate()) {
526      policies->Set(key::kDevicePolicyRefreshRate,
527                    POLICY_LEVEL_MANDATORY,
528                    POLICY_SCOPE_MACHINE,
529                    DecodeIntegerValue(container.device_policy_refresh_rate()),
530                    NULL);
531    }
532  }
533
534  if (policy.has_metrics_enabled()) {
535    const em::MetricsEnabledProto& container(policy.metrics_enabled());
536    if (container.has_metrics_enabled()) {
537      policies->Set(key::kDeviceMetricsReportingEnabled,
538                    POLICY_LEVEL_MANDATORY,
539                    POLICY_SCOPE_MACHINE,
540                    Value::CreateBooleanValue(container.metrics_enabled()),
541                    NULL);
542    }
543  }
544
545  if (policy.has_start_up_urls()) {
546    const em::StartUpUrlsProto& container(policy.start_up_urls());
547    ListValue* urls = new ListValue();
548    RepeatedPtrField<std::string>::const_iterator entry;
549    for (entry = container.start_up_urls().begin();
550         entry != container.start_up_urls().end();
551         ++entry) {
552      urls->Append(Value::CreateStringValue(*entry));
553    }
554    policies->Set(key::kDeviceStartUpUrls,
555                  POLICY_LEVEL_MANDATORY,
556                  POLICY_SCOPE_MACHINE,
557                  urls,
558                  NULL);
559  }
560
561  if (policy.has_system_timezone()) {
562    if (policy.system_timezone().has_timezone()) {
563      policies->Set(key::kSystemTimezone,
564                    POLICY_LEVEL_MANDATORY,
565                    POLICY_SCOPE_MACHINE,
566                    Value::CreateStringValue(
567                        policy.system_timezone().timezone()),
568                    NULL);
569    }
570  }
571
572  if (policy.has_use_24hour_clock()) {
573    if (policy.use_24hour_clock().has_use_24hour_clock()) {
574      policies->Set(key::kSystemUse24HourClock,
575                    POLICY_LEVEL_MANDATORY,
576                    POLICY_SCOPE_MACHINE,
577                    Value::CreateBooleanValue(
578                        policy.use_24hour_clock().use_24hour_clock()),
579                    NULL);
580    }
581  }
582
583  if (policy.has_allow_redeem_offers()) {
584    const em::AllowRedeemChromeOsRegistrationOffersProto& container(
585        policy.allow_redeem_offers());
586    if (container.has_allow_redeem_offers()) {
587      policies->Set(key::kDeviceAllowRedeemChromeOsRegistrationOffers,
588                    POLICY_LEVEL_MANDATORY,
589                    POLICY_SCOPE_MACHINE,
590                    Value::CreateBooleanValue(
591                        container.allow_redeem_offers()),
592                    NULL);
593    }
594  }
595
596  if (policy.has_uptime_limit()) {
597    const em::UptimeLimitProto& container(policy.uptime_limit());
598    if (container.has_uptime_limit()) {
599      policies->Set(key::kUptimeLimit,
600                    POLICY_LEVEL_MANDATORY,
601                    POLICY_SCOPE_MACHINE,
602                    DecodeIntegerValue(container.uptime_limit()),
603                    NULL);
604    }
605  }
606
607  if (policy.has_start_up_flags()) {
608    const em::StartUpFlagsProto& container(policy.start_up_flags());
609    ListValue* flags = new ListValue();
610    RepeatedPtrField<std::string>::const_iterator entry;
611    for (entry = container.flags().begin();
612         entry != container.flags().end();
613         ++entry) {
614      flags->Append(Value::CreateStringValue(*entry));
615    }
616    policies->Set(key::kDeviceStartUpFlags,
617                  POLICY_LEVEL_MANDATORY,
618                  POLICY_SCOPE_MACHINE,
619                  flags,
620                  NULL);
621  }
622
623  if (policy.has_variations_parameter()) {
624    if (policy.variations_parameter().has_parameter()) {
625      policies->Set(key::kDeviceVariationsRestrictParameter,
626                    POLICY_LEVEL_MANDATORY,
627                    POLICY_SCOPE_MACHINE,
628                    Value::CreateStringValue(
629                        policy.variations_parameter().parameter()),
630                    NULL);
631    }
632  }
633
634  if (policy.has_attestation_settings()) {
635    if (policy.attestation_settings().has_attestation_enabled()) {
636      policies->Set(key::kAttestationEnabledForDevice,
637                    POLICY_LEVEL_MANDATORY,
638                    POLICY_SCOPE_MACHINE,
639                    Value::CreateBooleanValue(
640                        policy.attestation_settings().attestation_enabled()),
641                    NULL);
642    }
643  }
644
645  if (policy.has_login_screen_power_management()) {
646    const em::LoginScreenPowerManagementProto& container(
647        policy.login_screen_power_management());
648    if (container.has_login_screen_power_management()) {
649      policies->Set(key::kDeviceLoginScreenPowerManagement,
650                    POLICY_LEVEL_MANDATORY,
651                    POLICY_SCOPE_MACHINE,
652                    Value::CreateStringValue(
653                        container.login_screen_power_management()),
654                    NULL);
655    }
656  }
657}
658
659}  // namespace
660
661void DecodeDevicePolicy(const em::ChromeDeviceSettingsProto& policy,
662                        PolicyMap* policies,
663                        EnterpriseInstallAttributes* install_attributes) {
664  // Decode the various groups of policies.
665  DecodeLoginPolicies(policy, policies);
666  DecodeKioskPolicies(policy, policies, install_attributes);
667  DecodeNetworkPolicies(policy, policies, install_attributes);
668  DecodeReportingPolicies(policy, policies);
669  DecodeAutoUpdatePolicies(policy, policies);
670  DecodeAccessibilityPolicies(policy, policies);
671  DecodeGenericPolicies(policy, policies);
672}
673
674}  // namespace policy
675