Accessing vmc through crosh might be hard to prevent - can't users edit the js of crosh using devtools?

Perhaps we need concierge_client binary to check whether the owner_id is permitted to access vmc, via a dbus call to a service in Chrome?

In answer to my own question, No, editing js won't let users bypass any profile checking. The crosh source is not js, and is not editable via devtools. 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bb0aad3bcb88c79c00fba124eaec40f7437b500f

commit bb0aad3bcb88c79c00fba124eaec40f7437b500f
Author: Nicholas Verne <nverne@chromium.org>
Date: Thu Jun 21 08:58:51 2018

Disable Crostini for children.

Also legacy supervised profiles.

Bug:  853198 
Change-Id: I8a42363f3f28476f4882605517eac9b1b3512200
Reviewed-on: https://chromium-review.googlesource.com/1103984
Commit-Queue: Nicholas Verne <nverne@chromium.org>
Reviewed-by: Ryo Hashimoto <hashimoto@chromium.org>
Reviewed-by: Timothy Loh <timloh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569194}
[modify] https://crrev.com/bb0aad3bcb88c79c00fba124eaec40f7437b500f/chrome/browser/chromeos/crostini/crostini_util.cc
[modify] https://crrev.com/bb0aad3bcb88c79c00fba124eaec40f7437b500f/chrome/browser/chromeos/crostini/crostini_util.h
[modify] https://crrev.com/bb0aad3bcb88c79c00fba124eaec40f7437b500f/chrome/browser/chromeos/dbus/finch_features_service_provider_delegate.cc
[modify] https://crrev.com/bb0aad3bcb88c79c00fba124eaec40f7437b500f/chrome/browser/chromeos/dbus/finch_features_service_provider_delegate.h
[modify] https://crrev.com/bb0aad3bcb88c79c00fba124eaec40f7437b500f/chromeos/dbus/services/chrome_features_service_provider.cc
[modify] https://crrev.com/bb0aad3bcb88c79c00fba124eaec40f7437b500f/chromeos/dbus/services/chrome_features_service_provider.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/d8f264efe3e6289e86cbb34ce18212b2c53d65e4

commit d8f264efe3e6289e86cbb34ce18212b2c53d65e4
Author: Nicholas Verne <nverne@chromium.org>
Date: Sat Jul 07 01:48:47 2018

crosh: send user_id_hash in messages to ChromeFeaturesService.

BUG= chromium:853198 
TEST=manual testing.

Change-Id: I33a5783221eddb389c43a3d4d9ad60b64c94f400
Reviewed-on: https://chromium-review.googlesource.com/1127503
Commit-Ready: Nicholas Verne <nverne@chromium.org>
Tested-by: Nicholas Verne <nverne@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/d8f264efe3e6289e86cbb34ce18212b2c53d65e4/crosh/crosh

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6adb1477be48d08b13f03353ae914c9551fe8cf0

commit 6adb1477be48d08b13f03353ae914c9551fe8cf0
Author: Nicholas Verne <nverne@chromium.org>
Date: Thu Jul 26 06:02:47 2018

Log an error when failing to pop user_id_hash

Bug:  853198 
Change-Id: I7e277fc98176a203e8fe13349cc77402546bff70
Reviewed-on: https://chromium-review.googlesource.com/1150942
Reviewed-by: Ryo Hashimoto <hashimoto@chromium.org>
Commit-Queue: Nicholas Verne <nverne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#578215}
[modify] https://crrev.com/6adb1477be48d08b13f03353ae914c9551fe8cf0/chromeos/dbus/services/chrome_features_service_provider.cc