update_engine: Modify Update Time Restrictions to block downloads
This makes Update Time Restrictions policy block downloads rather than
checks. This will allow for better capturing of metrics. Furthermore,
this change makes Update Time Restrictions only apply for kiosks, per
the discussion with security and PM.
The following changes are made:
* Use UpdateCanBeApplied rather than UpdateCheckAllowed in
UpdateTimeRestrictionsPolicyImpl.
* ChromeOSPolicy::UpdateCanBeApplied now checks for forced updates.
Modify the corresponding classes to implement UpdateCanBeApplied.
* Add the auto_launched_kiosk_app_id variable from libbrillo to the
policy provider, this variable lets us know if the device is in
kiosk-mode.
* If the device is not in kiosk mode, this policy won't be used.
* Change chromeos_policy to check for policies in UpdateCanBeApplied.
* Add unit tests accounting for the new changes.
BUG=chromium:852860
TEST=cros_workon_make update_engine --test
Change-Id: Iba52fa0fd1f89cc55e5009776036f8949e01e3a0
Reviewed-on: https://chromium-review.googlesource.com/1144435
Commit-Ready: Adolfo Higueros <adokar@google.com>
Tested-by: Adolfo Higueros <adokar@google.com>
Reviewed-by: Amin Hassani <ahassani@chromium.org>
diff --git a/update_manager/chromeos_policy.cc b/update_manager/chromeos_policy.cc
index f8ef84f..abb06c7 100644
--- a/update_manager/chromeos_policy.cc
+++ b/update_manager/chromeos_policy.cc
@@ -214,7 +214,6 @@
OobePolicyImpl oobe_policy;
NextUpdateCheckTimePolicyImpl next_update_check_time_policy(
kNextUpdateCheckPolicyConstants);
- UpdateTimeRestrictionsPolicyImpl update_time_restrictions_policy;
vector<Policy const*> policies_to_consult = {
// Do not perform any updates if there are not enough slots to do A/B
@@ -234,9 +233,6 @@
// If OOBE is enabled, wait until it is completed.
&oobe_policy,
- // Ensure that updates are checked only in allowed times.
- &update_time_restrictions_policy,
-
// Ensure that periodic update checks are timed properly.
&next_update_check_time_policy,
};
@@ -265,8 +261,33 @@
std::string* error,
ErrorCode* result,
InstallPlan* install_plan) const {
- *result = ErrorCode::kSuccess;
- return EvalStatus::kSucceeded;
+ UpdateTimeRestrictionsPolicyImpl update_time_restrictions_policy;
+ InteractiveUpdatePolicyImpl interactive_update_policy;
+
+ vector<Policy const*> policies_to_consult = {
+ // Check to see if an interactive update has been requested.
+ &interactive_update_policy,
+
+ // Do not apply or download an update if we are inside one of the
+ // restricted times.
+ &update_time_restrictions_policy,
+ };
+
+ EvalStatus status = ConsultPolicies(policies_to_consult,
+ &Policy::UpdateCanBeApplied,
+ ec,
+ state,
+ error,
+ result,
+ install_plan);
+ if (EvalStatus::kContinue != status) {
+ return status;
+ } else {
+ // The update can proceed.
+ LOG(INFO) << "Allowing update to be applied.";
+ *result = ErrorCode::kSuccess;
+ return EvalStatus::kSucceeded;
+ }
}
EvalStatus ChromeOSPolicy::UpdateCanStart(