1// 2// Copyright (C) 2017 The Android Open Source Project 3// 4// Licensed under the Apache License, Version 2.0 (the "License"); 5// you may not use this file except in compliance with the License. 6// You may obtain a copy of the License at 7// 8// http://www.apache.org/licenses/LICENSE-2.0 9// 10// Unless required by applicable law or agreed to in writing, software 11// distributed under the License is distributed on an "AS IS" BASIS, 12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13// See the License for the specific language governing permissions and 14// limitations under the License. 15// 16 17#include "update_engine/update_manager/enterprise_device_policy_impl.h" 18 19#include "update_engine/common/utils.h" 20 21using std::string; 22 23namespace chromeos_update_manager { 24 25// Check to see if Enterprise-managed (has DevicePolicy) and/or Kiosk-mode. If 26// so, then defer to those settings. 27EvalStatus EnterpriseDevicePolicyImpl::UpdateCheckAllowed( 28 EvaluationContext* ec, 29 State* state, 30 std::string* error, 31 UpdateCheckParams* result) const { 32 DevicePolicyProvider* const dp_provider = state->device_policy_provider(); 33 SystemProvider* const system_provider = state->system_provider(); 34 35 const bool* device_policy_is_loaded_p = 36 ec->GetValue(dp_provider->var_device_policy_is_loaded()); 37 if (device_policy_is_loaded_p && *device_policy_is_loaded_p) { 38 bool kiosk_app_control_chrome_version = false; 39 40 // Check whether updates are disabled by policy. 41 const bool* update_disabled_p = 42 ec->GetValue(dp_provider->var_update_disabled()); 43 if (update_disabled_p && *update_disabled_p) { 44 // Check whether allow kiosk app to control chrome version policy. This 45 // policy is only effective when AU is disabled by admin. 46 const bool* allow_kiosk_app_control_chrome_version_p = ec->GetValue( 47 dp_provider->var_allow_kiosk_app_control_chrome_version()); 48 kiosk_app_control_chrome_version = 49 allow_kiosk_app_control_chrome_version_p && 50 *allow_kiosk_app_control_chrome_version_p; 51 if (!kiosk_app_control_chrome_version) { 52 // No kiosk pin chrome version policy. AU is really disabled. 53 LOG(INFO) << "Updates disabled by policy, blocking update checks."; 54 return EvalStatus::kAskMeAgainLater; 55 } 56 } 57 58 if (kiosk_app_control_chrome_version) { 59 // Get the required platform version from Chrome. 60 const string* kiosk_required_platform_version_p = 61 ec->GetValue(system_provider->var_kiosk_required_platform_version()); 62 if (!kiosk_required_platform_version_p) { 63 LOG(INFO) << "Kiosk app required platform version is not fetched, " 64 "blocking update checks"; 65 return EvalStatus::kAskMeAgainLater; 66 } 67 68 result->target_version_prefix = *kiosk_required_platform_version_p; 69 LOG(INFO) << "Allow kiosk app to control Chrome version policy is set," 70 << ", target version is " 71 << (kiosk_required_platform_version_p 72 ? *kiosk_required_platform_version_p 73 : std::string("latest")); 74 } else { 75 // Determine whether a target version prefix is dictated by policy. 76 const string* target_version_prefix_p = 77 ec->GetValue(dp_provider->var_target_version_prefix()); 78 if (target_version_prefix_p) 79 result->target_version_prefix = *target_version_prefix_p; 80 } 81 82 // Determine whether a target channel is dictated by policy. 83 const bool* release_channel_delegated_p = 84 ec->GetValue(dp_provider->var_release_channel_delegated()); 85 if (release_channel_delegated_p && !(*release_channel_delegated_p)) { 86 const string* release_channel_p = 87 ec->GetValue(dp_provider->var_release_channel()); 88 if (release_channel_p) 89 result->target_channel = *release_channel_p; 90 } 91 } 92 return EvalStatus::kContinue; 93} 94 95} // namespace chromeos_update_manager 96