New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 707864 link

Starred by 1 user

Issue metadata

Status: Archived
Owner:
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

Public Session whitelisting - Remove Clipboard Read permission from extensions in Public Sessions (except for whitelisted ones)

Project Member Reported by isandrk@chromium.org, Apr 3 2017

Issue description

In Public Sessions, apps and extensions are force-installed by admin policy so the user does not get a chance to review the permissions for these apps. This is not acceptable from a security standpoint, so we remove ClipboardRead permission from them (except for whitelisted ones - eg. remote desktop clients). This forceful removal of permission is safe since the clipboard pasting code checks for this permission before doing the paste.
 
Project Member

Comment 1 by bugdroid1@chromium.org, Apr 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/80e3eb904ef28e2491b831099597fc05347845ae

commit 80e3eb904ef28e2491b831099597fc05347845ae
Author: isandrk <isandrk@chromium.org>
Date: Wed Apr 12 15:22:14 2017

PS - Remove Clipboard Read permission from extensions in Public Sessions (except for whitelisted ones)

In Public Sessions, apps and extensions are force-installed by admin policy so the user does not get a chance to review the permissions for these apps. This is not acceptable from a security standpoint, so we remove ClipboardRead permission from them (except for whitelisted ones - eg. remote desktop clients). This forceful removal of permission is safe since the clipboard pasting code checks for this permission before doing the paste.

TEST=
  unit_tests --gtest_filter=DeviceLocalAccountManagementPolicyProviderTest.IsWhitelisted
  unit_tests --gtest_filter=PermissionsUpdaterDelegateChromeOSTest.*
  unit_tests --gtest_filter=PermissionsUpdaterTest.Delegate
BUG= 707864 

Review-Url: https://codereview.chromium.org/2794803003
Cr-Commit-Position: refs/heads/master@{#464031}

[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/BUILD.gn
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider_unittest.cc
[add] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc
[add] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.h
[add] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos_unittest.cc
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/extensions/permissions_updater.cc
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/extensions/permissions_updater.h
[modify] https://crrev.com/80e3eb904ef28e2491b831099597fc05347845ae/chrome/browser/extensions/permissions_updater_unittest.cc

Status: Fixed (was: Started)
Project Member

Comment 3 by bugdroid1@chromium.org, Apr 25 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9074b2db8c610057e8ef1a2b3d53b93e7d23f918

commit 9074b2db8c610057e8ef1a2b3d53b93e7d23f918
Author: isandrk <isandrk@chromium.org>
Date: Tue Apr 25 15:18:24 2017

Whitelisted clipboardRead Permission

Follow up to crrev.com/2794803003 - forgot to actually whitelist the permission.

BUG= 707864 

Review-Url: https://codereview.chromium.org/2838173002
Cr-Commit-Position: refs/heads/master@{#466994}

[modify] https://crrev.com/9074b2db8c610057e8ef1a2b3d53b93e7d23f918/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

Just realized I introduced a bug. On the chrome://extensions page I broke the "Load unpacked extension..." feature - the popup wouldn't show any files to choose from.


Project Member

Comment 5 by bugdroid1@chromium.org, Apr 27 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/55180f5ed3cd7386ef97e044d4084e5fb9afc67a

commit 55180f5ed3cd7386ef97e044d4084e5fb9afc67a
Author: isandrk <isandrk@chromium.org>
Date: Thu Apr 27 10:20:40 2017

Fix for broken "Load unpacked extension" popup

In crrev.com/2794803003 I introduced a bug that caused "Load unpacked extension" screen (available under chrome://extensions) to not display any files. This CL fixes it.

BUG= 707864 

Review-Url: https://codereview.chromium.org/2840043002
Cr-Commit-Position: refs/heads/master@{#467631}

[modify] https://crrev.com/55180f5ed3cd7386ef97e044d4084e5fb9afc67a/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc
[modify] https://crrev.com/55180f5ed3cd7386ef97e044d4084e5fb9afc67a/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos_unittest.cc

Labels: Merge-Request-59
Project Member

Comment 7 by sheriffbot@chromium.org, May 3 2017

Labels: -Merge-Request-59 Hotlist-Merge-Approved Merge-Approved-59
Your change meets the bar and is auto-approved for M59. Please go ahead and merge the CL to branch 3071 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), gkihumba@(ChromeOS), Abdul Syed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by bugdroid1@chromium.org, May 3 2017

Labels: -merge-approved-59 merge-merged-3071
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ed50a4bd0a41ec21d07590743667881a70af1b3f

commit ed50a4bd0a41ec21d07590743667881a70af1b3f
Author: Ivan Sandrk <isandrk@google.com>
Date: Wed May 03 15:24:21 2017

[Merge to M59] Fix for broken "Load unpacked extension" popup

In crrev.com/2794803003 I introduced a bug that caused "Load unpacked extension" screen (available under chrome://extensions) to not display any files. This CL fixes it.

BUG= 707864 

Review-Url: https://codereview.chromium.org/2840043002
Cr-Commit-Position: refs/heads/master@{#467631}
(cherry picked from commit 55180f5ed3cd7386ef97e044d4084e5fb9afc67a)

Review-Url: https://codereview.chromium.org/2859783003 .
Cr-Commit-Position: refs/branch-heads/3071@{#373}
Cr-Branched-From: a106f0abbf69dad349d4aaf4bcc4f5d376dd2377-refs/heads/master@{#464641}

[modify] https://crrev.com/ed50a4bd0a41ec21d07590743667881a70af1b3f/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc
[modify] https://crrev.com/ed50a4bd0a41ec21d07590743667881a70af1b3f/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos_unittest.cc

Project Member

Comment 9 by bugdroid1@chromium.org, May 3 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ebd27c6f674b70fd93d7681f0e16f4d29a097989

commit ebd27c6f674b70fd93d7681f0e16f4d29a097989
Author: Ivan Sandrk <isandrk@google.com>
Date: Wed May 03 15:26:35 2017

[Merge to M59] Whitelisted clipboardRead Permission

Follow up to crrev.com/2794803003 - forgot to actually whitelist the permission.

BUG= 707864 

Review-Url: https://codereview.chromium.org/2838173002
Cr-Commit-Position: refs/heads/master@{#466994}
(cherry picked from commit 9074b2db8c610057e8ef1a2b3d53b93e7d23f918)

Review-Url: https://codereview.chromium.org/2860653004 .
Cr-Commit-Position: refs/branch-heads/3071@{#374}
Cr-Branched-From: a106f0abbf69dad349d4aaf4bcc4f5d376dd2377-refs/heads/master@{#464641}

[modify] https://crrev.com/ebd27c6f674b70fd93d7681f0e16f4d29a097989/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

Comment 10 by dchan@chromium.org, Jan 22 2018

Status: Archived (was: Fixed)

Sign in to add a comment