Because of this bug any user without administration privileges may disable ExtensionInstallForcelist policy for any extension.

Steps:

1. Locate Preferences file in Chromium profile
2. Find key with extension id under "extensions" key.
3. Change "state" key to "2". Example for GNOME Shell integration:
"extensions": {
	"gphhapmejobijbbhgpjhcjognlahblep": {
...
		"state": 2,
	},
...

1. Do you have other policies like ExtensionsInstallBlacklist configured too?
Because the message that you mentioned ("Extension... is blocked by the administrator") is usually displayed because of such policies. Also you refer to the sentence in the documentation that speaks about the ExtensionsInstallBlacklist policy.

2. After you put the chrome-gnome-shell.json file and run Chromium, are there any errors displayed on the chrome://extensions page?

3. It would be very helpful if you would attach two dumps of data displayed on the chrome://policy page: first before you put the JSON file with the policy, and second - after that.

4. Regarding blocking the extension by hacking a file in the Chrome profile. This is not very surprising, and not sure whether this can be considered as a security issue. Not only the profile files, but also the browser itself is running with the user's privileges, which means that administrator privileges are not required at all for tampering the browser.
We should, however, investigate whether it would be possible to suppress such tampering in this exact case, given that the admin policy should always take higher precedence.

> 1. Do you have other policies like ExtensionsInstallBlacklist configured too?
> 2. After you put the chrome-gnome-shell.json file and run Chromium, are there any errors displayed on the chrome://extensions page?

No

> 3. It would be very helpful if you would attach two dumps of data displayed on the chrome://policy page

Attached:

> first before you put the JSON file with the policy

with-external-before-managed.png

> and second - after that

without-external-with-managed.png

Deleted: with-external-before-managed.png 18.6 KB

	with-external-before-managed.png 18.6 KB View Download

Deleted: without-external-with-managed.png 27.5 KB

	without-external-with-managed.png 27.5 KB View Download

> the admin policy should always take higher precedence.

As I think that is how is should work.

But currently, extension state=2 (externaly installed extension blacklisted by user uninstall action?) is taking precendence over ExtensionInstallForcelist managed policy.

Currently testing a CL with a possible fix.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6699afb688a0c3b9d6eb85915bc475a3a3b46716

commit 6699afb688a0c3b9d6eb85915bc475a3a3b46716
Author: emaxx <emaxx@chromium.org>
Date: Mon Oct 10 21:22:13 2016

Fix force policy installation of the removed pref-installed extension

This fixes the issue with the extension not being force-installed
through the admin policy when it was previously installed by the
external preference and then manually removed by the user.

BUG= 651197 
TEST=Unit test

Review-Url: https://codereview.chromium.org/2409743002
Cr-Commit-Position: refs/heads/master@{#424245}

[modify] https://crrev.com/6699afb688a0c3b9d6eb85915bc475a3a3b46716/chrome/browser/extensions/extension_service_unittest.cc
[modify] https://crrev.com/6699afb688a0c3b9d6eb85915bc475a3a3b46716/chrome/browser/extensions/pending_extension_manager.cc

Thanks for fast fix!
Which stable version of Chromium will get this issue fixed?

The commit went into 56, which will be stable only in several months. But, after the fix in 56.* version gets tested, it will be decided which older branches should receive it too.

Can we check whether this is fixed on the recent builds?

Would it be possible to perform the test soon, so that the fix has a chance to go into 55?

Geetha, please have the Chrome on Linux team verify this in R56.

Is it included in 56 release?

And I hope you guys backport it to Chromium 55 too. Debian Stretch is shipping with version 55 and we'd like to see Chromium and GNOME Shell Extension  work out of the box.

Yes, the change went into 56 (>=56.0.2888.0) and into the following branches.

However, it was not backported into 55 and earlier releases. And most likely won't be now, given that this is not a security issue or any kind of complete breakage for the product users.