1//
2// Copyright (C) 2017 The Android Open Source Project
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8//      http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15//
16
17#include "update_engine/update_manager/enterprise_device_policy_impl.h"
18
19#include "update_engine/common/utils.h"
20
21using std::string;
22
23namespace chromeos_update_manager {
24
25// Check to see if Enterprise-managed (has DevicePolicy) and/or Kiosk-mode.  If
26// so, then defer to those settings.
27EvalStatus EnterpriseDevicePolicyImpl::UpdateCheckAllowed(
28    EvaluationContext* ec,
29    State* state,
30    std::string* error,
31    UpdateCheckParams* result) const {
32  DevicePolicyProvider* const dp_provider = state->device_policy_provider();
33  SystemProvider* const system_provider = state->system_provider();
34
35  const bool* device_policy_is_loaded_p =
36      ec->GetValue(dp_provider->var_device_policy_is_loaded());
37  if (device_policy_is_loaded_p && *device_policy_is_loaded_p) {
38    bool kiosk_app_control_chrome_version = false;
39
40    // Check whether updates are disabled by policy.
41    const bool* update_disabled_p =
42        ec->GetValue(dp_provider->var_update_disabled());
43    if (update_disabled_p && *update_disabled_p) {
44      // Check whether allow kiosk app to control chrome version policy. This
45      // policy is only effective when AU is disabled by admin.
46      const bool* allow_kiosk_app_control_chrome_version_p = ec->GetValue(
47          dp_provider->var_allow_kiosk_app_control_chrome_version());
48      kiosk_app_control_chrome_version =
49          allow_kiosk_app_control_chrome_version_p &&
50          *allow_kiosk_app_control_chrome_version_p;
51      if (!kiosk_app_control_chrome_version) {
52        // No kiosk pin chrome version policy. AU is really disabled.
53        LOG(INFO) << "Updates disabled by policy, blocking update checks.";
54        return EvalStatus::kAskMeAgainLater;
55      }
56    }
57
58    if (kiosk_app_control_chrome_version) {
59      // Get the required platform version from Chrome.
60      const string* kiosk_required_platform_version_p =
61          ec->GetValue(system_provider->var_kiosk_required_platform_version());
62      if (!kiosk_required_platform_version_p) {
63        LOG(INFO) << "Kiosk app required platform version is not fetched, "
64                     "blocking update checks";
65        return EvalStatus::kAskMeAgainLater;
66      }
67
68      result->target_version_prefix = *kiosk_required_platform_version_p;
69      LOG(INFO) << "Allow kiosk app to control Chrome version policy is set,"
70                << ", target version is "
71                << (kiosk_required_platform_version_p
72                        ? *kiosk_required_platform_version_p
73                        : std::string("latest"));
74    } else {
75      // Determine whether a target version prefix is dictated by policy.
76      const string* target_version_prefix_p =
77          ec->GetValue(dp_provider->var_target_version_prefix());
78      if (target_version_prefix_p)
79        result->target_version_prefix = *target_version_prefix_p;
80    }
81
82    // Determine whether a target channel is dictated by policy.
83    const bool* release_channel_delegated_p =
84        ec->GetValue(dp_provider->var_release_channel_delegated());
85    if (release_channel_delegated_p && !(*release_channel_delegated_p)) {
86      const string* release_channel_p =
87          ec->GetValue(dp_provider->var_release_channel());
88      if (release_channel_p)
89        result->target_channel = *release_channel_p;
90    }
91  }
92  return EvalStatus::kContinue;
93}
94
95}  // namespace chromeos_update_manager
96