You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
179 lines
7.9 KiB
179 lines
7.9 KiB
//
|
|
// Copyright (C) 2017 The Android Open Source Project
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//
|
|
|
|
#include "update_engine/update_manager/enterprise_device_policy_impl.h"
|
|
|
|
#include "update_engine/common/utils.h"
|
|
|
|
using std::string;
|
|
|
|
namespace chromeos_update_manager {
|
|
|
|
// Check to see if Enterprise-managed (has DevicePolicy) and/or Kiosk-mode. If
|
|
// so, then defer to those settings.
|
|
EvalStatus EnterpriseDevicePolicyImpl::UpdateCheckAllowed(
|
|
EvaluationContext* ec,
|
|
State* state,
|
|
std::string* error,
|
|
UpdateCheckParams* result) const {
|
|
DevicePolicyProvider* const dp_provider = state->device_policy_provider();
|
|
SystemProvider* const system_provider = state->system_provider();
|
|
|
|
const bool* device_policy_is_loaded_p =
|
|
ec->GetValue(dp_provider->var_device_policy_is_loaded());
|
|
if (device_policy_is_loaded_p && *device_policy_is_loaded_p) {
|
|
bool kiosk_app_control_chrome_version = false;
|
|
|
|
// Check whether updates are disabled by policy.
|
|
const bool* update_disabled_p =
|
|
ec->GetValue(dp_provider->var_update_disabled());
|
|
if (update_disabled_p && *update_disabled_p) {
|
|
// Check whether allow kiosk app to control chrome version policy. This
|
|
// policy is only effective when AU is disabled by admin.
|
|
const bool* allow_kiosk_app_control_chrome_version_p = ec->GetValue(
|
|
dp_provider->var_allow_kiosk_app_control_chrome_version());
|
|
kiosk_app_control_chrome_version =
|
|
allow_kiosk_app_control_chrome_version_p &&
|
|
*allow_kiosk_app_control_chrome_version_p;
|
|
if (!kiosk_app_control_chrome_version) {
|
|
// No kiosk pin chrome version policy. AU is really disabled.
|
|
LOG(INFO) << "Updates disabled by policy, blocking update checks.";
|
|
return EvalStatus::kAskMeAgainLater;
|
|
}
|
|
}
|
|
|
|
// By default, result->rollback_allowed is false.
|
|
if (kiosk_app_control_chrome_version) {
|
|
// Get the required platform version from Chrome.
|
|
const string* kiosk_required_platform_version_p =
|
|
ec->GetValue(system_provider->var_kiosk_required_platform_version());
|
|
if (!kiosk_required_platform_version_p) {
|
|
LOG(INFO) << "Kiosk app required platform version is not fetched, "
|
|
"blocking update checks.";
|
|
return EvalStatus::kAskMeAgainLater;
|
|
} else if (kiosk_required_platform_version_p->empty()) {
|
|
// The platform version could not be fetched several times. Update
|
|
// based on |DeviceMinimumVersion| instead (crbug.com/1048931).
|
|
const base::Version* device_minimum_version_p =
|
|
ec->GetValue(dp_provider->var_device_minimum_version());
|
|
const base::Version* current_version_p(
|
|
ec->GetValue(system_provider->var_chromeos_version()));
|
|
if (device_minimum_version_p && device_minimum_version_p->IsValid() &&
|
|
current_version_p && current_version_p->IsValid() &&
|
|
*current_version_p > *device_minimum_version_p) {
|
|
// Do not update if the current version is newer than the minimum
|
|
// version.
|
|
LOG(INFO) << "Reading kiosk app required platform version failed "
|
|
"repeatedly but current version is newer than "
|
|
"DeviceMinimumVersion. Blocking update checks. "
|
|
"Current version: "
|
|
<< *current_version_p
|
|
<< " DeviceMinimumVersion: " << *device_minimum_version_p;
|
|
return EvalStatus::kAskMeAgainLater;
|
|
}
|
|
LOG(WARNING) << "Reading kiosk app required platform version failed "
|
|
"repeatedly. Attempting an update without it now.";
|
|
// An empty string for |target_version_prefix| allows arbitrary updates.
|
|
result->target_version_prefix = "";
|
|
} else {
|
|
result->target_version_prefix = *kiosk_required_platform_version_p;
|
|
LOG(INFO) << "Allow kiosk app to control Chrome version policy is set, "
|
|
<< "target version is " << result->target_version_prefix;
|
|
}
|
|
// TODO(hunyadym): Add support for allowing rollback using the manifest
|
|
// (if policy doesn't specify otherwise).
|
|
} else {
|
|
// Determine whether a target version prefix is dictated by policy.
|
|
const string* target_version_prefix_p =
|
|
ec->GetValue(dp_provider->var_target_version_prefix());
|
|
if (target_version_prefix_p)
|
|
result->target_version_prefix = *target_version_prefix_p;
|
|
}
|
|
|
|
// Policy always overwrites whether rollback is allowed by the kiosk app
|
|
// manifest.
|
|
const RollbackToTargetVersion* rollback_to_target_version_p =
|
|
ec->GetValue(dp_provider->var_rollback_to_target_version());
|
|
if (rollback_to_target_version_p) {
|
|
switch (*rollback_to_target_version_p) {
|
|
case RollbackToTargetVersion::kUnspecified:
|
|
// We leave the default or the one specified by the kiosk app.
|
|
break;
|
|
case RollbackToTargetVersion::kDisabled:
|
|
LOG(INFO) << "Policy disables rollbacks.";
|
|
result->rollback_allowed = false;
|
|
result->rollback_data_save_requested = false;
|
|
break;
|
|
case RollbackToTargetVersion::kRollbackAndPowerwash:
|
|
LOG(INFO) << "Policy allows rollbacks with powerwash.";
|
|
result->rollback_allowed = true;
|
|
result->rollback_data_save_requested = false;
|
|
break;
|
|
case RollbackToTargetVersion::kRollbackAndRestoreIfPossible:
|
|
LOG(INFO)
|
|
<< "Policy allows rollbacks, also tries to restore if possible.";
|
|
result->rollback_allowed = true;
|
|
result->rollback_data_save_requested = true;
|
|
break;
|
|
case RollbackToTargetVersion::kMaxValue:
|
|
NOTREACHED();
|
|
// Don't add a default case to let the compiler warn about newly
|
|
// added enum values which should be added here.
|
|
}
|
|
}
|
|
|
|
// Determine allowed milestones for rollback
|
|
const int* rollback_allowed_milestones_p =
|
|
ec->GetValue(dp_provider->var_rollback_allowed_milestones());
|
|
if (rollback_allowed_milestones_p)
|
|
result->rollback_allowed_milestones = *rollback_allowed_milestones_p;
|
|
|
|
// Determine whether a target channel is dictated by policy and whether we
|
|
// should rollback in case that channel is more stable.
|
|
const bool* release_channel_delegated_p =
|
|
ec->GetValue(dp_provider->var_release_channel_delegated());
|
|
if (release_channel_delegated_p && !(*release_channel_delegated_p)) {
|
|
const string* release_channel_p =
|
|
ec->GetValue(dp_provider->var_release_channel());
|
|
if (release_channel_p) {
|
|
result->target_channel = *release_channel_p;
|
|
const ChannelDowngradeBehavior* channel_downgrade_behavior_p =
|
|
ec->GetValue(dp_provider->var_channel_downgrade_behavior());
|
|
if (channel_downgrade_behavior_p &&
|
|
*channel_downgrade_behavior_p ==
|
|
ChannelDowngradeBehavior::kRollback) {
|
|
result->rollback_on_channel_downgrade = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
const string* release_lts_tag_p =
|
|
ec->GetValue(dp_provider->var_release_lts_tag());
|
|
if (release_lts_tag_p) {
|
|
result->lts_tag = *release_lts_tag_p;
|
|
}
|
|
|
|
const string* quick_fix_build_token_p =
|
|
ec->GetValue(dp_provider->var_quick_fix_build_token());
|
|
if (quick_fix_build_token_p) {
|
|
result->quick_fix_build_token = *quick_fix_build_token_p;
|
|
}
|
|
}
|
|
return EvalStatus::kContinue;
|
|
}
|
|
|
|
} // namespace chromeos_update_manager
|