// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/ash/bruschetta/bruschetta_policy_handler.h"
#include "base/strings/string_number_conversions.h"
#include "base/values.h"
#include "build/build_config.h"
#include "chrome/browser/ash/bruschetta/bruschetta_pref_names.h"
#include "components/policy/core/browser/policy_error_map.h"
#include "components/policy/core/common/policy_map.h"
#include "components/policy/core/common/schema.h"
#include "components/policy/policy_constants.h"
#include "components/prefs/pref_value_map.h"
#include "components/strings/grit/components_strings.h"
#include "crypto/sha2.h"
#include "url/gurl.h"
namespace bruschetta {
namespace {
#if defined(ARCH_CPU_X86_64)
const char kPolicyImageKeyArchSpecific[] = "installer_image_x86_64";
const char kPolicyPflashKeyArchSpecific[] = "uefi_pflash_x86_64";
constexpr policy::PolicyMap::MessageType kUninstallableErrorLevel =
policy::PolicyMap::MessageType::kError;
#else
const char kPolicyImageKeyArchSpecific[] = "";
const char kPolicyPflashKeyArchSpecific[] = "";
constexpr policy::PolicyMap::MessageType kUninstallableErrorLevel =
policy::PolicyMap::MessageType::kInfo;
#endif
prefs::PolicyEnabledState EnabledStrToEnum(const std::string& str) {
if (str == "RUN_ALLOWED") {
return prefs::PolicyEnabledState::RUN_ALLOWED;
}
if (str == "INSTALL_ALLOWED") {
return prefs::PolicyEnabledState::INSTALL_ALLOWED;
}
return prefs::PolicyEnabledState::BLOCKED;
}
prefs::PolicyUpdateAction UpdateActionStrToEnum(const std::string& str) {
if (str == "NONE") {
return prefs::PolicyUpdateAction::NONE;
}
if (str == "FORCE_SHUTDOWN_ALWAYS") {
return prefs::PolicyUpdateAction::FORCE_SHUTDOWN_ALWAYS;
}
return prefs::PolicyUpdateAction::FORCE_SHUTDOWN_IF_MORE_RESTRICTED;
}
} // namespace
BruschettaPolicyHandler::BruschettaPolicyHandler(policy::Schema schema)
: policy::SimpleSchemaValidatingPolicyHandler(
policy::key::kBruschettaVMConfiguration,
prefs::kBruschettaVMConfiguration,
schema,
policy::SchemaOnErrorStrategy::SCHEMA_ALLOW_UNKNOWN,
policy::SimpleSchemaValidatingPolicyHandler::RECOMMENDED_PROHIBITED,
policy::SimpleSchemaValidatingPolicyHandler::MANDATORY_ALLOWED) {}
BruschettaPolicyHandler::~BruschettaPolicyHandler() = default;
bool BruschettaPolicyHandler::CheckDownloadableObject(
policy::PolicyErrorMap* errors,
const std::string& id,
const std::string& key,
const base::Value::Dict& dict) {
bool retval = true;
const auto* url_str = dict.FindString(prefs::kPolicyURLKey);
if (!GURL(*url_str).is_valid()) {
errors->AddError(policy_name(), IDS_POLICY_INVALID_URL_ERROR,
policy::PolicyErrorPath{id, key, prefs::kPolicyURLKey});
retval = false;
}
std::vector<uint8_t> hash_bytes;
const auto* hash_str = dict.FindString(prefs::kPolicyHashKey);
if (!base::HexStringToBytes(*hash_str, &hash_bytes) ||
hash_bytes.size() != crypto::kSHA256Length) {
errors->AddError(policy_name(), IDS_POLICY_INVALID_HASH_ERROR,
policy::PolicyErrorPath{id, key, prefs::kPolicyHashKey});
retval = false;
}
return retval;
}
bool BruschettaPolicyHandler::CheckPolicySettings(
const policy::PolicyMap& policies,
policy::PolicyErrorMap* errors) {
// Delegate to our super-class, which checks the JSON schema.
if (!policy::SimpleSchemaValidatingPolicyHandler::CheckPolicySettings(
policies, errors)) {
return false;
}
// Aside from outright schema violations we never reject a policy, we only
// downgrade configs from installable to runnable. This minimizes the damage
// caused by misconfigurations.
downgraded_by_error_.clear();
const base::Value* value =
policies.GetValue(policy_name(), base::Value::Type::DICT);
if (!value) {
return true;
}
for (const auto outer_config : value->GetDict()) {
const std::string& id = outer_config.first;
const base::Value::Dict& config = outer_config.second.GetDict();
bool valid_config = true;
const auto* installer_image = config.FindDict(kPolicyImageKeyArchSpecific);
if (installer_image) {
if (!CheckDownloadableObject(errors, id, kPolicyImageKeyArchSpecific,
*installer_image)) {
valid_config = false;
}
}
const auto* pflash = config.FindDict(kPolicyPflashKeyArchSpecific);
if (pflash) {
if (!CheckDownloadableObject(errors, id, kPolicyPflashKeyArchSpecific,
*pflash)) {
valid_config = false;
}
}
if (EnabledStrToEnum(*config.FindString(prefs::kPolicyEnabledKey)) ==
prefs::PolicyEnabledState::INSTALL_ALLOWED) {
if (!installer_image) {
// This is an error on x86_64, since that's currently our *only*
// supported architecture so this definitely indicates a
// misconfiguration, but we also leave an informational level message
// for arm devices to be helpful.
errors->AddError(policy_name(),
IDS_POLICY_BRUSCHETTA_UNINSTALLABLE_ERROR,
policy::PolicyErrorPath{id}, kUninstallableErrorLevel);
}
if (!installer_image || !valid_config) {
downgraded_by_error_.insert(id);
}
}
}
return true;
}
void BruschettaPolicyHandler::ApplyPolicySettings(
const policy::PolicyMap& policies,
PrefValueMap* prefs) {
const base::Value* value =
policies.GetValue(policy_name(), base::Value::Type::DICT);
if (!value)
return;
// We can mostly skip error checking here because by this point the policy has
// already been checked against the schema.
base::Value::Dict pref;
for (const auto outer_config : value->GetDict()) {
const std::string& id = outer_config.first;
const base::Value::Dict& config = outer_config.second.GetDict();
base::Value::Dict pref_config;
bool installable;
{
pref_config.Set(prefs::kPolicyNameKey,
*config.FindString(prefs::kPolicyNameKey));
}
{
auto policy_enabled =
EnabledStrToEnum(*config.FindString(prefs::kPolicyEnabledKey));
if (downgraded_by_error_.contains(id)) {
policy_enabled =
std::min(policy_enabled, prefs::PolicyEnabledState::RUN_ALLOWED);
}
pref_config.Set(prefs::kPolicyEnabledKey,
static_cast<int>(policy_enabled));
installable =
(policy_enabled == prefs::PolicyEnabledState::INSTALL_ALLOWED);
}
{
const auto* installer_image =
config.FindDict(kPolicyImageKeyArchSpecific);
if (installer_image && installable) {
pref_config.Set(prefs::kPolicyImageKey, installer_image->Clone());
}
}
{
const auto* pflash = config.FindDict(kPolicyPflashKeyArchSpecific);
if (pflash && installable) {
pref_config.Set(prefs::kPolicyPflashKey, pflash->Clone());
}
}
{
const auto* vtpm = config.FindDict(prefs::kPolicyVTPMKey);
bool vtpm_enabled = false;
prefs::PolicyUpdateAction vtpm_update_action =
prefs::PolicyUpdateAction::FORCE_SHUTDOWN_IF_MORE_RESTRICTED;
if (vtpm) {
vtpm_enabled = *vtpm->FindBool(prefs::kPolicyVTPMEnabledKey);
const auto* vtpm_update_action_str =
vtpm->FindString(prefs::kPolicyVTPMUpdateActionKey);
if (vtpm_update_action_str) {
vtpm_update_action = UpdateActionStrToEnum(*vtpm_update_action_str);
}
}
base::Value::Dict pref_vtpm;
pref_vtpm.Set(prefs::kPolicyVTPMEnabledKey, vtpm_enabled);
pref_vtpm.Set(prefs::kPolicyVTPMUpdateActionKey,
static_cast<int>(vtpm_update_action));
pref_config.Set(prefs::kPolicyVTPMKey, std::move(pref_vtpm));
}
{
base::Value::List pref_oem_strings;
const auto* oem_strings = config.FindList(prefs::kPolicyOEMStringsKey);
if (oem_strings) {
for (const auto& oem_string : *oem_strings) {
pref_oem_strings.Append(oem_string.GetString());
}
}
pref_config.Set(prefs::kPolicyOEMStringsKey, std::move(pref_oem_strings));
}
{
pref_config.Set(
prefs::kPolicyDisplayOrderKey,
config.FindInt(prefs::kPolicyDisplayOrderKey).value_or(0));
}
pref.Set(id, std::move(pref_config));
}
prefs->SetValue(prefs::kBruschettaVMConfiguration,
base::Value(std::move(pref)));
}
} // namespace bruschetta
Codebase Browser
chromium