PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

[AUTO][FILECONTROL] - version 131.0.6778.70 (#1642)

Browse Source 
[AUTO][FILECONTROL] - version 131.0.6778.70
This commit is contained in:
uazo
2024-11-16 02:13:24 -12:00
committed by GitHub
parent 19cd8e5aac ec538a5763
commit 135f502be4
1475 changed files with 48413 additions and 2860 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/under-control/src/RELEASE
+1 -1
View File
@@ -1 +1 @@
130.0.6723.67
131.0.6778.70
tools/under-control/src/android_webview/browser/aw_content_browser_client.cc
+75 -25
View File
@@ -22,6 +22,7 @@
#include "android_webview/browser/aw_contents_io_thread_client.h"
#include "android_webview/browser/aw_cookie_access_policy.h"
#include "android_webview/browser/aw_devtools_manager_delegate.h"
#include "android_webview/browser/aw_enterprise_helper.h"
#include "android_webview/browser/aw_feature_list_creator.h"
#include "android_webview/browser/aw_http_auth_handler.h"
#include "android_webview/browser/aw_settings.h"
@@ -109,6 +110,7 @@
#include "mojo/public/cpp/bindings/pending_receiver.h"
#include "net/android/network_library.h"
#include "net/cookies/site_for_cookies.h"
#include "net/dns/public/secure_dns_mode.h"
#include "net/http/http_util.h"
#include "net/net_buildflags.h"
#include "net/ssl/ssl_cert_request_info.h"
@@ -155,7 +157,7 @@ bool g_check_cleartext_permitted = false;
BASE_FEATURE(kWebViewOptimizeXrwNavigationFlow,
"WebViewOptimizeXrwNavigationFlow",
base::FEATURE_DISABLED_BY_DEFAULT);
base::FEATURE_ENABLED_BY_DEFAULT);
// A throttle which checks if the XRW origin trial is enabled for this
// navigation, and forwards it to the proxying loader factory.
@@ -269,7 +271,7 @@ AwContentBrowserClient::AwContentBrowserClient(
DCHECK(aw_feature_list_creator_);
}
AwContentBrowserClient::~AwContentBrowserClient() {}
AwContentBrowserClient::~AwContentBrowserClient() = default;
void AwContentBrowserClient::OnNetworkServiceCreated(
network::mojom::NetworkService* network_service) {
@@ -279,15 +281,31 @@ void AwContentBrowserClient::OnNetworkServiceCreated(
content::GetCertVerifierServiceFactory()->SetUseChromeRootStore(
false, base::DoNothing());
content::GetNetworkService()->SetUpHttpAuth(
network::mojom::HttpAuthStaticParams::New());
content::GetNetworkService()->ConfigureHttpAuthPrefs(
network_service->SetUpHttpAuth(network::mojom::HttpAuthStaticParams::New());
network_service->ConfigureHttpAuthPrefs(
AwBrowserProcess::GetInstance()->CreateHttpAuthDynamicParams());
if (base::FeatureList::IsEnabled(features::kWebViewAsyncDns)) {
content::GetNetworkService()->ConfigureStubHostResolver(
/*insecure_dns_client_enabled=*/true, net::SecureDnsMode::kAutomatic,
net::DnsOverHttpsConfig(),
/*additional_dns_types_enabled=*/true);
enterprise::GetEnterpriseState(
base::BindOnce([](enterprise::EnterpriseState state) {
switch (state) {
case enterprise::EnterpriseState::kUnknown:
// If we cannot be certain about the enterprise state, we should
// not enable the AsyncDNS resolver, but fall back on the system
// resolver.
case enterprise::EnterpriseState::kEnterpriseOwned:
// On enterprise owned devices, we should use the system resolver
// to make sure that we respect any network settings implemented
// by the device owner.
return;
case enterprise::EnterpriseState::kNotOwned:
content::GetNetworkService()->ConfigureStubHostResolver(
/*insecure_dns_client_enabled=*/true,
net::SecureDnsMode::kAutomatic, net::DnsOverHttpsConfig(),
/*additional_dns_types_enabled=*/true);
break;
}
}));
}
}
@@ -870,7 +888,8 @@ AwContentBrowserClient::CreateLoginDelegate(
content::WebContents* web_contents,
content::BrowserContext* browser_context,
const content::GlobalRequestID& request_id,
bool is_request_for_primary_main_frame,
bool is_request_for_primary_main_frame_navigation,
bool is_request_for_navigation,
const GURL& url,
scoped_refptr<net::HttpResponseHeaders> response_headers,
bool first_auth_attempt,
@@ -892,6 +911,7 @@ bool AwContentBrowserClient::HandleExternalProtocol(
bool has_user_gesture,
const std::optional<url::Origin>& initiating_origin,
content::RenderFrameHost* initiator_document,
const net::IsolationInfo& isolation_info,
mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory) {
// Sandbox flags
// =============
@@ -912,6 +932,15 @@ bool AwContentBrowserClient::HandleExternalProtocol(
static_cast<AwBrowserContext*>(
web_contents->GetBrowserContext()));
// Pass WebContentsKey to look up AwContentsIoThreadClient in
// WebContentsToIoThreadClientMap later. Currently this is used only when a
// page is being prerendered.
// TODO(crbug.com/373474043): Use this even for non-prerendered pages.
std::optional<WebContentsKey> web_contents_key;
if (web_contents && web_contents->IsPrerenderedFrame(frame_tree_node_id)) {
web_contents_key = GetWebContentsKey(*web_contents);
}
// We don't need to care for |security_options| as the factories constructed
// below are used only for navigation.
// We also don't care about retrieving cookies in this case because these will
@@ -922,7 +951,7 @@ bool AwContentBrowserClient::HandleExternalProtocol(
// Manages its own lifetime.
new android_webview::AwProxyingURLLoaderFactory(
std::nullopt /* cookie_manager */, nullptr /* cookie_access_policy */,
std::nullopt /* isolation_info*/, frame_tree_node_id,
isolation_info, web_contents_key, frame_tree_node_id,
std::move(receiver), mojo::NullRemote(), true /* intercept_only */,
std::nullopt /* security_options */,
nullptr /* xrw_allowlist_matcher */, std::move(browser_context_handle),
@@ -932,23 +961,24 @@ bool AwContentBrowserClient::HandleExternalProtocol(
FROM_HERE,
base::BindOnce(
[](mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
std::optional<WebContentsKey> web_contents_key,
content::FrameTreeNodeId frame_tree_node_id,
scoped_refptr<AwBrowserContextIoThreadHandle>
browser_context_handle) {
browser_context_handle,
const net::IsolationInfo& isolation_info) {
// Manages its own lifetime.
new android_webview::AwProxyingURLLoaderFactory(
std::nullopt /* cookie_manager */,
nullptr /* cookie_access_policy */,
std::nullopt /* isolation_info*/, frame_tree_node_id,
std::move(receiver), mojo::NullRemote(),
true /* intercept_only */,
nullptr /* cookie_access_policy */, isolation_info,
web_contents_key, frame_tree_node_id, std::move(receiver),
mojo::NullRemote(), true /* intercept_only */,
std::nullopt /* security_options */,
nullptr /* xrw_allowlist_matcher */,
std::move(browser_context_handle),
std::nullopt /* navigation_id */);
},
std::move(receiver), frame_tree_node_id,
std::move(browser_context_handle)));
std::move(receiver), web_contents_key, frame_tree_node_id,
std::move(browser_context_handle), isolation_info));
}
return false;
}
@@ -1113,17 +1143,27 @@ void AwContentBrowserClient::WillCreateURLLoaderFactory(
preferences.allow_universal_access_from_file_urls;
}
// Pass WebContentsKey to look up AwContentsIoThreadClient in
// WebContentsToIoThreadClientMap later. Currently this is used only when a
// page is being prerendered.
// TODO(crbug.com/373474043): Use this even for non-prerendered pages.
std::optional<WebContentsKey> web_contents_key;
if (web_contents->IsPrerenderedFrame(frame->GetFrameTreeNodeId())) {
web_contents_key = GetWebContentsKey(*web_contents);
}
auto xrw_allowlist_matcher =
AwSettings::FromWebContents(web_contents)->xrw_allowlist_matcher();
content::GetIOThreadTaskRunner({})->PostTask(
FROM_HERE,
base::BindOnce(
&AwProxyingURLLoaderFactory::CreateProxy, std::move(cookie_manager),
cookie_access_policy, isolation_info, frame->GetFrameTreeNodeId(),
std::move(proxied_receiver), std::move(target_factory_remote),
security_options, std::move(xrw_allowlist_matcher),
std::move(browser_context_handle), navigation_id));
base::BindOnce(&AwProxyingURLLoaderFactory::CreateProxy,
std::move(cookie_manager), cookie_access_policy,
isolation_info, web_contents_key,
frame->GetFrameTreeNodeId(), std::move(proxied_receiver),
std::move(target_factory_remote), security_options,
std::move(xrw_allowlist_matcher),
std::move(browser_context_handle), navigation_id));
} else {
// A service worker and worker subresources set nullptr to |frame|, and
// work without seeing the AllowUniversalAccessFromFileURLs setting. So,
@@ -1132,7 +1172,8 @@ void AwContentBrowserClient::WillCreateURLLoaderFactory(
FROM_HERE,
base::BindOnce(
&AwProxyingURLLoaderFactory::CreateProxy, std::move(cookie_manager),
cookie_access_policy, isolation_info, content::FrameTreeNodeId(),
cookie_access_policy, isolation_info,
/*web_contents_key=*/std::nullopt, content::FrameTreeNodeId(),
std::move(proxied_receiver), std::move(target_factory_remote),
std::nullopt /* security_options */,
aw_browser_context->service_worker_xrw_allowlist_matcher(),
@@ -1435,4 +1476,13 @@ bool AwContentBrowserClient::IsFullCookieAccessAllowed(
return aw_settings->GetAllowThirdPartyCookies();
}
bool AwContentBrowserClient::AllowNonActivatedCrossOriginPaintHolding() {
// In WebView, we allow non-activated cross-origin paint holding, since apps
// currently experience this behavior and are in control of what to show.
// TODO(crbug.com/368087192): We can consider disabling it while monitoring
// for any breakages.
return true;
}
} // namespace android_webview
tools/under-control/src/android_webview/browser/aw_field_trials.cc
+15
View File
@@ -26,6 +26,7 @@
#include "net/base/features.h"
#include "services/network/public/cpp/features.h"
#include "third_party/blink/public/common/features.h"
#include "third_party/blink/public/common/features_generated.h"
#include "ui/android/ui_android_features.h"
#include "ui/gl/gl_features.h"
@@ -222,6 +223,8 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
// FedCM is not yet supported on WebView.
aw_feature_overrides.DisableFeature(::features::kFedCm);
aw_feature_overrides.DisableFeature(
blink::features::kFedCmWithStorageAccessAPI);
// TODO(crbug.com/40272633): Web MIDI permission prompt for all usage.
aw_feature_overrides.DisableFeature(blink::features::kBlockMidiByDefault);
@@ -278,4 +281,16 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
// TODO(crbug.com/41492947): See crrev.com/c/5744034 for details, but I was
// unable to add this feature to fieldtrial_testing_config and pass all tests.
aw_feature_overrides.EnableFeature(blink::features::kElementGetInnerHTML);
// These features have shown performance improvements in WebView but not some
// other platforms.
aw_feature_overrides.EnableFeature(features::kEnsureExistingRendererAlive);
aw_feature_overrides.EnableFeature(blink::features::kThreadedBodyLoader);
aw_feature_overrides.EnableFeature(blink::features::kThreadedPreloadScanner);
aw_feature_overrides.EnableFeature(blink::features::kPrecompileInlineScripts);
// This feature has not been experimented with yet on WebView.
// TODO(crbug.com/336852432): Enable this feature for WebView.
aw_feature_overrides.DisableFeature(
blink::features::kNavigationPredictorNewViewportFeatures);
}
tools/under-control/src/chrome/android/java/AndroidManifest.xml
+9 -21
View File
@@ -69,7 +69,11 @@ by a child template that "extends" this file.
<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.DOWNLOAD_WITHOUT_NOTIFICATION" />
<uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
{% set is_desktop_android = is_desktop_android|default(0) %}
{% if is_desktop_android == "true" %}
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_CAMERA" />
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_MICROPHONE" />
{% endif %}
<!-- TODO(crbug.com/40259231): Remove this tools:ignore attribute once it's no longer necessary. -->
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" tools:ignore="SystemPermissionTypo" />
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" tools:ignore="SystemPermissionTypo" />
@@ -861,25 +865,6 @@ by a child template that "extends" this file.
android:launchMode="singleTop">
</activity>
<!-- configChanges is set here to prevent the destruction of the
activity after configuration changes. Since the bulk of this
activity's logic is in a feature module, restoring the activity
via a Bundle doesn't work. -->
<activity
android:name="org.chromium.chrome.browser.webauth.authenticator.CableAuthenticatorUSBActivity"
android:configChanges="density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|mcc|mnc|navigation|orientation|screenLayout|screenSize|smallestScreenSize|touchscreen|uiMode"
android:theme="@style/Theme.Chromium.Activity.Fullscreen"
android:label="@string/cablev2_activity_title"
android:exported="false"
android:excludeFromRecents="true"
android:launchMode="singleTop">
<intent-filter>
<action android:name="android.hardware.usb.action.USB_ACCESSORY_ATTACHED" />
</intent-filter>
<meta-data android:name="android.hardware.usb.action.USB_ACCESSORY_ATTACHED"
android:resource="@xml/phone_as_a_security_key_accessory_filter" />
</activity>
<receiver
android:name="org.chromium.chrome.browser.browserservices.ui.trustedwebactivity.DisclosureAcceptanceBroadcastReceiver"
android:exported="false" />
@@ -1091,7 +1076,7 @@ by a child template that "extends" this file.
<activity
android:name="org.chromium.chrome.browser.notifications.NotificationIntentInterceptor$TrampolineActivity"
android:theme="@style/Theme.BrowserUI.NoDisplay"
android:theme="@style/Theme.BrowserUI.Translucent.NoTitleBar"
android:exported="false"
android:autoRemoveFromRecents="true"
android:excludeFromRecents="true"
@@ -1136,6 +1121,9 @@ by a child template that "extends" this file.
android:exported="false"/>
<service android:name="org.chromium.chrome.browser.media.MediaCaptureNotificationService"
{% if is_desktop_android == "true" %}
android:foregroundServiceType="camera|microphone"
{% endif %}
android:exported="false"/>
<service android:name="org.chromium.chrome.browser.media.ui.ChromeMediaNotificationControllerServices$PlaybackListenerService"
android:foregroundServiceType="mediaPlayback" android:exported="false">
tools/under-control/src/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
+31 -6
View File
@@ -12,6 +12,7 @@
#include <vector>
#include "base/barrier_closure.h"
#include "base/check_deref.h"
#include "base/containers/flat_set.h"
#include "base/containers/to_vector.h"
#include "base/feature_list.h"
@@ -41,8 +42,7 @@
#include "chrome/browser/content_settings/host_content_settings_map_factory.h"
#include "chrome/browser/crash_upload_list/crash_upload_list.h"
#include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
#include "chrome/browser/dips/dips_service.h"
#include "chrome/browser/dips/dips_service_factory.h"
#include "chrome/browser/dips/dips_service_impl.h"
#include "chrome/browser/dips/dips_utils.h"
#include "chrome/browser/domain_reliability/service_factory.h"
#include "chrome/browser/downgrade/user_data_downgrade.h"
@@ -74,6 +74,7 @@
#include "chrome/browser/reading_list/reading_list_model_factory.h"
#include "chrome/browser/safe_browsing/safe_browsing_service.h"
#include "chrome/browser/safe_browsing/verdict_cache_manager_factory.h"
#include "chrome/browser/search_engine_choice/search_engine_choice_service_factory.h"
#include "chrome/browser/search_engines/template_url_service_factory.h"
#include "chrome/browser/share/share_history.h"
#include "chrome/browser/share/share_ranking.h"
@@ -85,7 +86,6 @@
#include "chrome/browser/translate/chrome_translate_client.h"
#include "chrome/browser/ui/find_bar/find_bar_state.h"
#include "chrome/browser/ui/find_bar/find_bar_state_factory.h"
#include "chrome/browser/user_annotations/user_annotations_service_factory.h"
#include "chrome/browser/webauthn/chrome_authenticator_request_delegate.h"
#include "chrome/browser/webdata_services/web_data_service_factory.h"
#include "chrome/common/buildflags.h"
@@ -132,6 +132,7 @@
#include "components/privacy_sandbox/privacy_sandbox_settings.h"
#include "components/reading_list/core/reading_list_model.h"
#include "components/safe_browsing/core/browser/verdict_cache_manager.h"
#include "components/search_engines/search_engine_choice/search_engine_choice_service.h"
#include "components/search_engines/template_url_service.h"
#include "components/signin/public/base/consent_level.h"
#include "components/signin/public/base/gaia_id_hash.h"
@@ -142,7 +143,6 @@
#include "components/sync/service/sync_service.h"
#include "components/sync/service/sync_user_settings.h"
#include "components/tpcd/metadata/browser/manager.h"
#include "components/user_annotations/user_annotations_service.h"
#include "components/web_cache/browser/web_cache_manager.h"
#include "components/webrtc_logging/browser/log_cleanup.h"
#include "components/webrtc_logging/browser/text_log_list.h"
@@ -185,12 +185,14 @@
#if !BUILDFLAG(IS_ANDROID)
#include "chrome/browser/user_annotations/user_annotations_service_factory.h"
#include "chrome/browser/user_education/browser_feature_promo_storage_service.h"
#include "chrome/browser/web_applications/web_app.h"
#include "chrome/browser/web_applications/web_app_command_scheduler.h"
#include "chrome/browser/web_applications/web_app_provider.h"
#include "chrome/browser/web_applications/web_app_registrar.h"
#include "chrome/browser/web_applications/web_app_utils.h"
#include "components/user_annotations/user_annotations_service.h"
#include "content/public/browser/isolated_web_apps_policy.h"
#include "content/public/browser/storage_partition_config.h"
#endif // !BUILDFLAG(IS_ANDROID)
@@ -901,8 +903,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
}
if (dips_mask != DIPSEventRemovalType::kNone) {
auto* dips_service = DIPSServiceFactory::GetForBrowserContext(profile_);
if (dips_service) {
if (DIPSServiceImpl* dips_service = DIPSServiceImpl::Get(profile_)) {
dips_service->RemoveEvents(delete_begin_, delete_end_,
filter_builder->BuildNetworkServiceFilter(),
dips_mask);
@@ -1068,11 +1069,13 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
FROM_HERE, base::DoNothing(),
CreateTaskCompletionClosure(TracingDataType::kAutofillData));
}
#if !BUILDFLAG(IS_ANDROID)
if (auto* user_annotations_service =
UserAnnotationsServiceFactory::GetForProfile(profile_)) {
user_annotations_service->RemoveAnnotationsInRange(delete_begin_,
delete_end_);
}
#endif
}
//////////////////////////////////////////////////////////////////////////////
@@ -1478,6 +1481,28 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
});
}
}
if (remove_mask & constants::DATA_TYPE_SEARCH_ENGINE_CHOICE) {
// Clear the search engine choice prefs.
// TODO(b/312180262): Consider clearing other Guest preferences as well.
// TODO(crbug.com/369959287): Delete the Guest OTR profile object instead of
// wiping it.
search_engines::WipeSearchEngineChoicePrefs(
// For Guest profiles, the OTR is the one that gets wiped, but the
// choice prefs get set on the parent profile. For other OTR profiles,
// we don't want to automatically forward to the original profile, the
// choice made is still relevant there. This method is also called for
// regular profiles, when they are deleted. We don't really care about
// resetting the pref in that case, because the full directory will be
// deleted anyway.
CHECK_DEREF((profile_->IsGuestSession() ? profile_->GetOriginalProfile()
: profile_.get())
->GetPrefs()),
search_engines::WipeSearchEngineChoiceReason::kProfileWipe);
search_engines::SearchEngineChoiceServiceFactory::GetForProfile(profile_)
->ResetState();
}
}
void ChromeBrowsingDataRemoverDelegate::OnTaskStarted(
tools/under-control/src/chrome/browser/chrome_browser_interface_binders.cc
+64 -37
View File
@@ -6,6 +6,7 @@
#include <utility>
#include "ash/constants/ash_features.h"
#include "base/feature_list.h"
#include "base/functional/bind.h"
#include "base/strings/stringprintf.h"
@@ -80,7 +81,7 @@
#include "components/no_state_prefetch/browser/no_state_prefetch_contents.h"
#include "components/no_state_prefetch/browser/no_state_prefetch_processor_impl.h"
#include "components/performance_manager/embedder/binders.h"
#include "components/performance_manager/public/performance_manager.h"
#include "components/performance_manager/embedder/performance_manager_registry.h"
#include "components/prefs/pref_service.h"
#include "components/privacy_sandbox/privacy_sandbox_features.h"
#include "components/reading_list/features/reading_list_switches.h"
@@ -135,6 +136,7 @@
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
#include "chrome/browser/ui/webui/app_settings/web_app_settings_ui.h"
#include "chrome/browser/ui/webui/on_device_translation_internals/on_device_translation_internals_ui.h"
#include "ui/webui/resources/cr_components/app_management/app_management.mojom.h"
#endif
@@ -154,6 +156,7 @@
#include "chrome/browser/cart/chrome_cart.mojom.h"
#include "chrome/browser/new_tab_page/modules/file_suggestion/file_suggestion.mojom.h"
#include "chrome/browser/new_tab_page/modules/v2/calendar/google_calendar.mojom.h"
#include "chrome/browser/new_tab_page/modules/v2/calendar/outlook_calendar.mojom.h"
#include "chrome/browser/new_tab_page/modules/v2/most_relevant_tab_resumption/most_relevant_tab_resumption.mojom.h"
#include "chrome/browser/new_tab_page/new_tab_page_util.h"
#include "chrome/browser/payments/payment_request_factory.h"
@@ -222,15 +225,12 @@
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
BUILDFLAG(IS_CHROMEOS)
#include "chrome/browser/companion/visual_query/visual_query_suggestions_service_factory.h"
#include "chrome/browser/screen_ai/screen_ai_service_router.h"
#include "chrome/browser/screen_ai/screen_ai_service_router_factory.h"
#include "chrome/browser/ui/web_applications/sub_apps_service_impl.h"
#include "chrome/browser/ui/webui/discards/discards.mojom.h"
#include "chrome/browser/ui/webui/discards/discards_ui.h"
#include "chrome/browser/ui/webui/discards/site_data.mojom.h"
#include "chrome/common/companion/visual_query.mojom.h"
#include "chrome/common/companion/visual_query/features.h"
#endif // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) ||
// BUILDFLAG(IS_CHROMEOS)
@@ -280,6 +280,10 @@
#include "ash/webui/firmware_update_ui/mojom/firmware_update.mojom.h"
#include "ash/webui/focus_mode/focus_mode_ui.h"
#include "ash/webui/focus_mode/mojom/focus_mode.mojom.h"
#include "ash/webui/graduation/graduation_ui.h"
#include "ash/webui/graduation/mojom/graduation_ui.mojom.h"
#include "ash/webui/growth_internals/growth_internals.mojom.h"
#include "ash/webui/growth_internals/growth_internals_ui.h"
#include "ash/webui/help_app_ui/help_app_ui.h"
#include "ash/webui/help_app_ui/help_app_ui.mojom.h"
#include "ash/webui/help_app_ui/help_app_untrusted_ui.h"
@@ -348,6 +352,7 @@
#include "chrome/browser/ui/webui/ash/internet/internet_detail_dialog.h"
#include "chrome/browser/ui/webui/ash/launcher_internals/launcher_internals.mojom.h"
#include "chrome/browser/ui/webui/ash/launcher_internals/launcher_internals_ui.h"
#include "chrome/browser/ui/webui/ash/lobster/lobster.mojom.h"
#include "chrome/browser/ui/webui/ash/lock_screen_reauth/lock_screen_network_ui.h"
#include "chrome/browser/ui/webui/ash/login/mojom/screens_factory.mojom.h"
#include "chrome/browser/ui/webui/ash/login/oobe_ui.h"
@@ -371,6 +376,7 @@
#include "chrome/browser/ui/webui/ash/settings/pages/device/input_device_settings/input_device_settings_provider.mojom.h"
#include "chrome/browser/ui/webui/ash/settings/pages/files/mojom/google_drive_handler.mojom.h"
#include "chrome/browser/ui/webui/ash/settings/pages/files/mojom/one_drive_handler.mojom.h"
#include "chrome/browser/ui/webui/ash/settings/pages/people/mojom/graduation_handler.mojom.h"
#include "chrome/browser/ui/webui/ash/settings/pages/privacy/mojom/app_permission_handler.mojom.h"
#include "chrome/browser/ui/webui/ash/settings/pages/search/mojom/magic_boost_handler.mojom.h"
#include "chrome/browser/ui/webui/ash/settings/search/mojom/search.mojom.h"
@@ -878,17 +884,6 @@ void BindScreen2xMainContentExtractor(
frame_host->GetProcess()->GetBrowserContext())
->BindMainContentExtractor(std::move(receiver));
}
void BindVisualSuggestionsModelProvider(
content::RenderFrameHost* frame_host,
mojo::PendingReceiver<
companion::visual_query::mojom::VisualSuggestionsModelProvider>
receiver) {
companion::visual_query::VisualQuerySuggestionsServiceFactory::GetForProfile(
Profile::FromBrowserContext(
frame_host->GetProcess()->GetBrowserContext()))
->BindModelReceiver(std::move(receiver));
}
#endif
#if BUILDFLAG(IS_CHROMEOS_LACROS)
@@ -972,10 +967,10 @@ void PopulateChromeFrameBinders(
map->Add<blink::mojom::NoStatePrefetchProcessor>(
base::BindRepeating(&BindNoStatePrefetchProcessor));
if (performance_manager::PerformanceManager::IsAvailable()) {
map->Add<performance_manager::mojom::DocumentCoordinationUnit>(
base::BindRepeating(
&performance_manager::BindDocumentCoordinationUnit));
auto* pm_registry =
performance_manager::PerformanceManagerRegistry::GetInstance();
if (pm_registry) {
pm_registry->GetBinders().ExposeInterfacesToRenderFrame(map);
}
map->Add<translate::mojom::ContentTranslateDriver>(
@@ -1093,12 +1088,6 @@ void PopulateChromeFrameBinders(
base::BindRepeating(&web_app::SubAppsServiceImpl::CreateIfAllowed));
}
if (companion::visual_query::features::
IsVisualQuerySuggestionsAgentEnabled()) {
map->Add<companion::visual_query::mojom::VisualSuggestionsModelProvider>(
base::BindRepeating(&BindVisualSuggestionsModelProvider));
}
if (features::IsPdfOcrEnabled()) {
map->Add<screen_ai::mojom::ScreenAIAnnotator>(
base::BindRepeating(&BindScreenAIAnnotator));
@@ -1193,6 +1182,10 @@ void PopulateChromeWebUIFrameBinders(
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
RegisterWebUIControllerInterfaceBinder<
app_management::mojom::PageHandlerFactory, WebAppSettingsUI>(map);
RegisterWebUIControllerInterfaceBinder<
on_device_translation_internals::mojom::PageHandlerFactory,
OnDeviceTranslationInternalsUI>(map);
#endif
#if !BUILDFLAG(IS_ANDROID)
@@ -1239,7 +1232,8 @@ void PopulateChromeWebUIFrameBinders(
ash::EmojiUI, ash::RemoteMaintenanceCurtainUI,
ash::app_install::AppInstallDialogUI, ash::SanitizeDialogUI,
ash::printing::print_preview::PrintPreviewCrosUI,
ash::extended_updates::ExtendedUpdatesUI,
ash::extended_updates::ExtendedUpdatesUI, ash::graduation::GraduationUI,
policy::local_user_files::LocalFilesMigrationUI,
#endif
NewTabPageUI, OmniboxPopupUI, BookmarksSidePanelUI, CustomizeChromeUI,
InternalsUI, ReadingListUI, TabSearchUI, WebuiGalleryUI,
@@ -1268,8 +1262,16 @@ void PopulateChromeWebUIFrameBinders(
}
}
if (history_embeddings::IsHistoryEmbeddingsEnabled()) {
RegisterWebUIControllerInterfaceBinder<
history_embeddings::mojom::PageHandler, HistoryUI>(map);
if (history_clusters_service &&
history_clusters_service->is_journeys_feature_flag_enabled() &&
base::FeatureList::IsEnabled(history_clusters::kSidePanelJourneys)) {
RegisterWebUIControllerInterfaceBinder<
history_embeddings::mojom::PageHandler, HistoryUI,
HistoryClustersSidePanelUI>(map);
} else {
RegisterWebUIControllerInterfaceBinder<
history_embeddings::mojom::PageHandler, HistoryUI>(map);
}
}
RegisterWebUIControllerInterfaceBinder<
@@ -1317,7 +1319,8 @@ void PopulateChromeWebUIFrameBinders(
RegisterWebUIControllerInterfaceBinder<
help_bubble::mojom::HelpBubbleHandlerFactory, InternalsUI,
settings::SettingsUI, ReadingListUI, NewTabPageUI, CustomizeChromeUI,
PasswordManagerUI, HistoryUI
PasswordManagerUI, HistoryUI, lens::LensOverlayUntrustedUI,
lens::LensSidePanelUntrustedUI
#if !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_ANDROID)
,
ProfilePickerUI
@@ -1346,6 +1349,11 @@ void PopulateChromeWebUIFrameBinders(
ntp::calendar::mojom::GoogleCalendarPageHandler, NewTabPageUI>(map);
}
if (base::FeatureList::IsEnabled(ntp_features::kNtpOutlookCalendarModule)) {
RegisterWebUIControllerInterfaceBinder<
ntp::calendar::mojom::OutlookCalendarPageHandler, NewTabPageUI>(map);
}
#if BUILDFLAG(IS_CHROMEOS_ASH)
if (ash::features::IsBluetoothDisconnectWarningEnabled()) {
RegisterWebUIControllerInterfaceBinder<
@@ -1466,6 +1474,10 @@ void PopulateChromeWebUIFrameBinders(
ash::common::mojom::ShortcutInputProvider, ash::settings::OSSettingsUI,
ash::ShortcutCustomizationAppUI>(map);
RegisterWebUIControllerInterfaceBinder<
ash::settings::graduation::mojom::GraduationHandler,
ash::settings::OSSettingsUI>(map);
RegisterWebUIControllerInterfaceBinder<
ash::cellular_setup::mojom::CellularSetup, ash::settings::OSSettingsUI>(
map);
@@ -1522,12 +1534,10 @@ void PopulateChromeWebUIFrameBinders(
ash::OobeUI, ash::settings::OSSettingsUI, ash::LockScreenNetworkUI,
ash::ShimlessRMADialogUI>(map);
if (ash::features::IsPasspointSettingsEnabled()) {
RegisterWebUIControllerInterfaceBinder<
chromeos::connectivity::mojom::PasspointService,
ash::InternetDetailDialogUI, ash::NetworkUI,
ash::settings::OSSettingsUI>(map);
}
RegisterWebUIControllerInterfaceBinder<
chromeos::connectivity::mojom::PasspointService,
ash::InternetDetailDialogUI, ash::NetworkUI, ash::settings::OSSettingsUI>(
map);
RegisterWebUIControllerInterfaceBinder<
chromeos::printing::printing_manager::mojom::PrintingMetadataProvider,
@@ -1776,6 +1786,11 @@ void PopulateChromeWebUIFrameBinders(
policy::local_user_files::mojom::PageHandlerFactory,
policy::local_user_files::LocalFilesMigrationUI>(map);
}
if (ash::features::IsGrowthInternalsEnabled()) {
RegisterWebUIControllerInterfaceBinder<ash::growth::mojom::PageHandler,
ash::GrowthInternalsUI>(map);
}
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
@@ -1883,6 +1898,14 @@ void PopulateChromeWebUIFrameBinders(
RegisterWebUIControllerInterfaceBinder<
ash::sanitize_ui::mojom::SettingsResetter, ash::SanitizeDialogUI>(map);
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
#if BUILDFLAG(IS_CHROMEOS_ASH)
if (ash::features::IsGraduationEnabled()) {
RegisterWebUIControllerInterfaceBinder<
ash::graduation_ui::mojom::GraduationUiHandler,
ash::graduation::GraduationUI>(map);
}
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
}
void PopulateChromeWebUIFrameInterfaceBrokers(
@@ -1936,9 +1959,11 @@ void PopulateChromeWebUIFrameInterfaceBrokers(
.Add<color_change_listener::mojom::PageHandler>();
}
if (chromeos::features::IsOrcaEnabled()) {
if (chromeos::features::IsOrcaEnabled() ||
ash::features::IsLobsterEnabled()) {
registry.ForWebUI<ash::MakoUntrustedUI>()
.Add<ash::orca::mojom::EditorClient>();
.Add<ash::orca::mojom::EditorClient>()
.Add<lobster::mojom::UntrustedLobsterPageHandler>();
}
registry.ForWebUI<ash::DemoModeAppUntrustedUI>()
@@ -1977,12 +2002,14 @@ void PopulateChromeWebUIFrameInterfaceBrokers(
registry.ForWebUI<lens::LensSidePanelUntrustedUI>()
.Add<lens::mojom::LensSidePanelPageHandlerFactory>()
.Add<searchbox::mojom::PageHandler>()
.Add<help_bubble::mojom::HelpBubbleHandlerFactory>()
.Add<color_change_listener::mojom::PageHandler>();
}
if (lens::features::IsLensOverlayEnabled()) {
registry.ForWebUI<lens::LensOverlayUntrustedUI>()
.Add<lens::mojom::LensPageHandlerFactory>()
.Add<color_change_listener::mojom::PageHandler>()
.Add<help_bubble::mojom::HelpBubbleHandlerFactory>()
.Add<searchbox::mojom::PageHandler>();
}
if (lens::features::IsLensOverlaySearchBubbleEnabled()) {
tools/under-control/src/chrome/browser/chrome_content_browser_client.cc
+261 -161
View File
@@ -102,11 +102,13 @@
#include "chrome/browser/memory/chrome_browser_main_extra_parts_memory.h"
#include "chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.h"
#include "chrome/browser/metrics/chrome_feature_list_creator.h"
#include "chrome/browser/metrics/chrome_metrics_service_accessor.h"
#include "chrome/browser/navigation_predictor/anchor_element_preloader.h"
#include "chrome/browser/net/chrome_network_delegate.h"
#include "chrome/browser/net/profile_network_context_service.h"
#include "chrome/browser/net/profile_network_context_service_factory.h"
#include "chrome/browser/net/system_network_context_manager.h"
#include "chrome/browser/on_device_translation/service_controller.h"
#include "chrome/browser/optimization_guide/chrome_browser_main_extra_parts_optimization_guide.h"
#include "chrome/browser/payments/payment_request_display_manager_factory.h"
#include "chrome/browser/performance_manager/public/chrome_browser_main_extra_parts_performance_manager.h"
@@ -152,6 +154,7 @@
#include "chrome/browser/safe_browsing/url_checker_delegate_impl.h"
#include "chrome/browser/safe_browsing/url_lookup_service_factory.h"
#include "chrome/browser/search/search.h"
#include "chrome/browser/search_engines/template_url_service_factory.h"
#include "chrome/browser/segmentation_platform/chrome_browser_main_extra_parts_segmentation_platform.h"
#include "chrome/browser/sharing/sms/sms_remote_fetcher.h"
#include "chrome/browser/signin/chrome_signin_proxying_url_loader_factory.h"
@@ -189,6 +192,7 @@
#include "chrome/browser/ui/prefs/pref_watcher.h"
#include "chrome/browser/ui/tab_contents/chrome_web_contents_view_delegate.h"
#include "chrome/browser/ui/ui_features.h"
#include "chrome/browser/ui/web_applications/navigation_capturing_redirection_throttle.h"
#include "chrome/browser/ui/webid/identity_dialog_controller.h"
#include "chrome/browser/ui/webui/chrome_web_ui_controller_factory.h"
#include "chrome/browser/ui/webui/log_web_ui_url.h"
@@ -278,6 +282,7 @@
#include "components/payments/content/payment_request_display_manager.h"
#include "components/pdf/common/pdf_util.h"
#include "components/performance_manager/embedder/performance_manager_registry.h"
#include "components/performance_manager/public/scenarios/performance_scenarios.h"
#include "components/permissions/permission_context_base.h"
#include "components/policy/content/policy_blocklist_navigation_throttle.h"
#include "components/policy/content/policy_blocklist_service.h"
@@ -304,6 +309,7 @@
#include "components/safe_browsing/core/common/features.h"
#include "components/safe_browsing/core/common/hashprefix_realtime/hash_realtime_utils.h"
#include "components/safe_browsing/core/common/safe_browsing_prefs.h"
#include "components/search_engines/template_url_service.h"
#include "components/security_interstitials/content/insecure_form_navigation_throttle.h"
#include "components/security_interstitials/content/ssl_error_handler.h"
#include "components/security_interstitials/content/ssl_error_navigation_throttle.h"
@@ -427,9 +433,11 @@
#include "base/win/windows_version.h"
#include "chrome/browser/chrome_browser_main_win.h"
#include "chrome/browser/lifetime/application_lifetime_desktop.h"
#include "chrome/browser/performance_manager/public/dll_pre_read_policy_win.h"
#include "chrome/install_static/install_util.h"
#include "chrome/services/util_win/public/mojom/util_win.mojom.h"
#include "sandbox/win/src/sandbox_policy.h"
#include "ui/accessibility/accessibility_features.h"
#elif BUILDFLAG(IS_MAC)
#include "chrome/browser/browser_process_platform_part_mac.h"
#include "chrome/browser/chrome_browser_main_mac.h"
@@ -455,10 +463,8 @@
#include "chrome/browser/ash/arc/fileapi/arc_content_file_system_backend_delegate.h"
#include "chrome/browser/ash/arc/fileapi/arc_documents_provider_backend_delegate.h"
#include "chrome/browser/ash/boca/on_task/on_task_locked_session_navigation_throttle.h"
#include "chrome/browser/ash/chrome_browser_main_parts_ash.h"
#include "chrome/browser/ash/crosapi/browser_util.h"
#include "chrome/browser/ash/drive/fileapi/drivefs_file_system_backend_delegate.h"
#include "chrome/browser/ash/file_manager/app_id.h"
#include "chrome/browser/ash/file_system_provider/fileapi/backend_delegate.h"
#include "chrome/browser/ash/fileapi/external_file_url_loader_factory.h"
#include "chrome/browser/ash/fileapi/file_system_backend.h"
@@ -467,6 +473,7 @@
#include "chrome/browser/ash/login/signin/merge_session_throttling_utils.h"
#include "chrome/browser/ash/login/signin_partition_manager.h"
#include "chrome/browser/ash/login/startup_utils.h"
#include "chrome/browser/ash/main_parts/chrome_browser_main_parts_ash.h"
#include "chrome/browser/ash/net/network_health/network_health_manager.h"
#include "chrome/browser/ash/net/system_proxy_manager.h"
#include "chrome/browser/ash/profiles/profile_helper.h"
@@ -628,6 +635,7 @@
#include "chrome/browser/enterprise/chrome_browser_main_extra_parts_enterprise.h"
#include "chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.h"
#include "chrome/browser/enterprise/profile_management/profile_management_navigation_throttle.h"
#include "chrome/browser/enterprise/signin/managed_profile_required_navigation_throttle.h"
#include "chrome/browser/ui/webui/app_settings/web_app_settings_navigation_throttle.h"
#endif
@@ -757,7 +765,6 @@
#include "chromeos/crosapi/mojom/kerberos_in_browser.mojom.h"
#include "chromeos/lacros/lacros_service.h"
#include "chromeos/startup/browser_init_params.h"
#include "chromeos/startup/browser_postlogin_params.h"
#include "chromeos/startup/startup.h" // nogncheck
#include "chromeos/startup/startup_switches.h" // nogncheck
#include "mojo/core/embedder/embedder.h"
@@ -788,10 +795,6 @@
#include "chrome/common/bound_session_request_throttled_handler.h"
#endif // BUILDFLAG(ENABLE_BOUND_SESSION_CREDENTIALS)
#if BUILDFLAG(IS_CHROMEOS)
#include "chromeos/components/kiosk/kiosk_utils.h"
#endif // BUILDFLAG(IS_CHROMEOS)
#if BUILDFLAG(ENTERPRISE_DATA_CONTROLS) && !BUILDFLAG(IS_ANDROID)
#include "chrome/browser/enterprise/data_protection/data_protection_clipboard_utils.h"
#include "chrome/browser/enterprise/data_protection/paste_allowed_request.h"
@@ -849,6 +852,10 @@ BASE_FEATURE(kPrivateNetworkAccessRestrictionsForAutomotive,
base::FEATURE_ENABLED_BY_DEFAULT);
#endif // BUILDFLAG(IS_ANDROID)
BASE_FEATURE(kSkipPagehideInCommitForDSENavigation,
"SkipPagehideInCommitForDSENavigation",
base::FEATURE_DISABLED_BY_DEFAULT);
// A small ChromeBrowserMainExtraParts that invokes a callback when threads are
// ready. Used to initialize ChromeContentBrowserClient data that needs the UI
// thread.
@@ -1351,44 +1358,6 @@ bool IsErrorPageAutoReloadEnabled() {
return true;
}
// Checks whether a render process hosting a top chrome page exists.
bool IsTopChromeRendererPresent(Profile* profile) {
for (auto rph_iterator = content::RenderProcessHost::AllHostsIterator();
!rph_iterator.IsAtEnd(); rph_iterator.Advance()) {
content::RenderProcessHost* rph = rph_iterator.GetCurrentValue();
// Consider only valid RenderProcessHosts that belong to the current
// profile.
if (rph->IsInitializedAndNotDead() &&
profile->IsSameOrParent(
Profile::FromBrowserContext(rph->GetBrowserContext()))) {
bool is_top_chrome_renderer_present = false;
rph->ForEachRenderFrameHost(
[&is_top_chrome_renderer_present](content::RenderFrameHost* rfh) {
is_top_chrome_renderer_present |=
IsTopChromeWebUIURL(rfh->GetSiteInstance()->GetSiteURL());
});
// Return true if a rph hosting a top chrome WebUI has been found.
if (is_top_chrome_renderer_present)
return true;
}
}
return false;
}
// Return false if a top chrome renderer exists. This is done to ensure the
// spare renderer is not taken and the existing top chrome renderer is
// considered instead.
// TODO(crbug.com/1291351, tluk): This is needed since spare renderers are
// considered before existing processes for reuse. This can be simplified by
// migrating to SiteInstanceGroups once the project has landed.
bool ShouldUseSpareRenderProcessHostForTopChromePage(Profile* profile) {
return base::FeatureList::IsEnabled(
features::kTopChromeWebUIUsesSpareRenderer) &&
!IsTopChromeRendererPresent(profile);
}
#if BUILDFLAG(IS_CHROMEOS)
void NotifyMultiCaptureStarted(const std::string& label,
content::WebContents* web_contents,
@@ -1676,8 +1645,8 @@ void ChromeContentBrowserClient::RegisterProfilePrefs(
/*default_value=*/false);
registry->RegisterBooleanPref(
policy::policy_prefs::kBeforeunloadEventCancelByPreventDefaultEnabled,
true);
policy::policy_prefs::kSelectParserRelaxationEnabled,
/*default_value=*/true);
registry->RegisterBooleanPref(
policy::policy_prefs::kKeyboardFocusableScrollersEnabled, true);
@@ -1697,6 +1666,8 @@ void ChromeContentBrowserClient::RegisterProfilePrefs(
registry->RegisterListPref(
prefs::kSubAppsAPIsAllowedWithoutGestureAndAuthorizationForOrigins);
#endif
registry->RegisterBooleanPref(prefs::kWebAudioOutputBufferingEnabled, false);
}
// static
@@ -2158,13 +2129,6 @@ ChromeContentBrowserClient::ShouldUseSpareRenderProcessHost(
return SpareProcessRefusedByEmbedderReason::NoProfile;
}
// Returning false here will ensure existing Top Chrome WebUI renderers are
// considered for process reuse over the spare renderer.
if (IsTopChromeWebUIURL(site_url) &&
!ShouldUseSpareRenderProcessHostForTopChromePage(profile)) {
return SpareProcessRefusedByEmbedderReason::TopFrameChromeWebUI;
}
#if !BUILDFLAG(IS_ANDROID)
// Instant renderers should not use a spare process, because they require
// passing switches::kInstantProcess to the renderer process when it
@@ -2361,6 +2325,21 @@ bool ChromeContentBrowserClient::HasCustomSchemeHandler(
return false;
}
bool ChromeContentBrowserClient::HasWebRequestAPIProxy(
content::BrowserContext* browser_context) {
#if BUILDFLAG(ENABLE_EXTENSIONS)
const auto* web_request_api =
extensions::BrowserContextKeyedAPIFactory<extensions::WebRequestAPI>::Get(
browser_context);
if (!web_request_api) {
return false;
}
return web_request_api && web_request_api->MayHaveProxies();
#else
return false;
#endif
}
bool ChromeContentBrowserClient::CanCommitURL(
content::RenderProcessHost* process_host,
const GURL& url) {
@@ -2648,13 +2627,6 @@ bool ChromeContentBrowserClient::ShouldUrlUseApplicationIsolationLevel(
bool ChromeContentBrowserClient::IsIsolatedContextAllowedForUrl(
content::BrowserContext* browser_context,
const GURL& lock_url) {
#if BUILDFLAG(IS_CHROMEOS)
if (base::FeatureList::IsEnabled(features::kWebKioskEnableIwaApis) &&
chromeos::IsWebKioskSession()) {
return true;
}
#endif
#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
if (ChromeContentBrowserClientExtensionsPart::AreExtensionsDisabledForProfile(
browser_context)) {
@@ -2786,19 +2758,12 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
*base::CommandLine::ForCurrentProcess();
#if BUILDFLAG(IS_CHROMEOS_LACROS)
// Pass startup and post-login parameter FDs to child processes in Lacros.
// Pass startup parameter FDs to child processes in Lacros.
if (process_type != switches::kZygoteProcess) {
constexpr int kStartupDataFD =
kCrosStartupDataDescriptor + base::GlobalDescriptors::kBaseDescriptor;
command_line->AppendSwitchASCII(chromeos::switches::kCrosStartupDataFD,
base::NumberToString(kStartupDataFD));
if (chromeos::IsLaunchedWithPostLoginParams()) {
constexpr int kPostLoginDataFD = kCrosPostLoginDataDescriptor +
base::GlobalDescriptors::kBaseDescriptor;
command_line->AppendSwitchASCII(chromeos::switches::kCrosPostLoginDataFD,
base::NumberToString(kPostLoginDataFD));
}
}
#endif // BUILDFLAG(IS_CHROMEOS_LACROS)
@@ -2879,6 +2844,11 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
command_line->AppendSwitch(
blink::switches::kCSSCustomStateDeprecatedSyntaxEnabled);
}
if (!prefs->GetBoolean(
policy::policy_prefs::kSelectParserRelaxationEnabled)) {
command_line->AppendSwitch(
blink::switches::kDisableSelectParserRelaxation);
}
if (prefs->GetBoolean(policy::policy_prefs::
kForcePermissionPolicyUnloadDefaultEnabled)) {
@@ -2886,6 +2856,11 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
blink::switches::kForcePermissionPolicyUnloadDefaultEnabled);
}
if (prefs->GetBoolean(prefs::kWebAudioOutputBufferingEnabled)) {
command_line->AppendSwitch(
blink::switches::kWebAudioBypassOutputBufferingOptOut);
}
#if !BUILDFLAG(IS_ANDROID)
InstantService* instant_service =
InstantServiceFactory::GetForProfile(profile);
@@ -2989,47 +2964,49 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
// Please keep this in alphabetical order.
static const char* const kSwitchNames[] = {
autofill::switches::kIgnoreAutocompleteOffForAutofill,
autofill::switches::kShowAutofillSignatures,
autofill::switches::kIgnoreAutocompleteOffForAutofill,
autofill::switches::kShowAutofillSignatures,
#if BUILDFLAG(IS_CHROMEOS_ASH)
switches::kShortMergeSessionTimeoutForTest, // For tests only.
switches::kShortMergeSessionTimeoutForTest, // For tests only.
#endif
#if BUILDFLAG(ENABLE_EXTENSIONS)
extensions::switches::kAllowHTTPBackgroundPage,
extensions::switches::kAllowLegacyExtensionManifests,
extensions::switches::kDisableExtensionsHttpThrottling,
extensions::switches::kEnableExperimentalExtensionApis,
extensions::switches::kExtensionsOnChromeURLs,
extensions::switches::kSetExtensionThrottleTestParams, // For tests only.
extensions::switches::kAllowlistedExtensionID,
extensions::switches::kExtensionTestApiOnWebPages, // For tests only.
extensions::switches::kAllowHTTPBackgroundPage,
extensions::switches::kAllowLegacyExtensionManifests,
extensions::switches::kDisableExtensionsHttpThrottling,
extensions::switches::kEnableExperimentalExtensionApis,
extensions::switches::kExtensionsOnChromeURLs,
extensions::switches::kSetExtensionThrottleTestParams, // For tests
// only.
extensions::switches::kAllowlistedExtensionID,
extensions::switches::kExtensionTestApiOnWebPages, // For tests only.
#endif
switches::kAllowInsecureLocalhost,
switches::kAppsGalleryURL,
switches::kDisableJavaScriptHarmonyShipping,
variations::switches::kEnableBenchmarking,
switches::kEnableDistillabilityService,
switches::kEnableNaCl,
switches::kAllowInsecureLocalhost,
switches::kAppsGalleryURL,
switches::kDisableJavaScriptHarmonyShipping,
variations::switches::kEnableBenchmarking,
switches::kEnableDistillabilityService,
switches::kEnableNaCl,
#if BUILDFLAG(ENABLE_NACL)
switches::kEnableNaClDebug,
switches::kEnableNaClDebug,
#endif
switches::kEnableNetBenchmarking,
switches::kEnableNetBenchmarking,
switches::kExtensionAiDataCollection,
#if BUILDFLAG(IS_CHROMEOS)
chromeos::switches::
kTelemetryExtensionPwaOriginOverrideForTesting, // For tests only.
switches::kForceAppMode,
chromeos::switches::
kTelemetryExtensionPwaOriginOverrideForTesting, // For tests only.
switches::kForceAppMode,
#endif
#if BUILDFLAG(ENABLE_NACL)
switches::kForcePNaClSubzero,
switches::kForcePNaClSubzero,
#endif
switches::kForceUIDirection,
switches::kIgnoreGooglePortNumbers,
switches::kJavaScriptHarmony,
switches::kEnableExperimentalWebAssemblyFeatures,
embedder_support::kOriginTrialDisabledFeatures,
embedder_support::kOriginTrialPublicKey,
switches::kReaderModeHeuristics,
translate::switches::kTranslateSecurityOrigin,
switches::kForceUIDirection,
switches::kIgnoreGooglePortNumbers,
switches::kJavaScriptHarmony,
switches::kEnableExperimentalWebAssemblyFeatures,
embedder_support::kOriginTrialDisabledFeatures,
embedder_support::kOriginTrialPublicKey,
switches::kReaderModeHeuristics,
translate::switches::kTranslateSecurityOrigin,
};
command_line->CopySwitchesFrom(browser_command_line, kSwitchNames);
@@ -3040,6 +3017,7 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
extensions::switches::kEnableExperimentalExtensionApis,
extensions::switches::kExtensionsOnChromeURLs,
extensions::switches::kAllowlistedExtensionID,
switches::kExtensionAiDataCollection,
};
command_line->CopySwitchesFrom(browser_command_line, kSwitchNames);
@@ -3091,7 +3069,7 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
#endif
#if BUILDFLAG(IS_WIN)
if (base::FeatureList::IsEnabled(features::kNoPreReadMainDll)) {
if (!performance_manager::ShouldPreReadDllInChild()) {
command_line->AppendSwitch(switches::kNoPreReadMainDll);
}
#endif
@@ -3481,47 +3459,26 @@ bool ChromeContentBrowserClient::IsInterestGroupAPIAllowed(
bool ChromeContentBrowserClient::IsPrivacySandboxReportingDestinationAttested(
content::BrowserContext* browser_context,
const url::Origin& destination_origin,
content::PrivacySandboxInvokingAPI invoking_api,
bool post_impression_reporting) {
content::PrivacySandboxInvokingAPI invoking_api) {
Profile* profile = Profile::FromBrowserContext(browser_context);
auto* privacy_sandbox_settings =
PrivacySandboxSettingsFactory::GetForProfile(profile);
DCHECK(privacy_sandbox_settings);
if (invoking_api == content::PrivacySandboxInvokingAPI::kProtectedAudience) {
if (base::FeatureList::IsEnabled(
blink::features::kFencedFramesReportingAttestationsChanges) &&
post_impression_reporting) {
// M120 and afterwards: For beacons sent by `reportEvent()` and automatic
// beacons, the destination is required to be attested for either
// Protected Audience or Attribution Reporting.
return privacy_sandbox_settings->IsEventReportingDestinationAttested(
destination_origin,
privacy_sandbox::PrivacySandboxAttestationsGatedAPI::
kProtectedAudience) ||
privacy_sandbox_settings->IsEventReportingDestinationAttested(
destination_origin,
privacy_sandbox::PrivacySandboxAttestationsGatedAPI::
kAttributionReporting);
} else {
// Before M120: The reporting destination is required to be attested for
// its invoking API only.
// M120 and afterwards: For beacons sent by `reportResult()` and
// `reportWin()`, the destination is required to be attested for Protected
// Audience only.
return privacy_sandbox_settings->IsEventReportingDestinationAttested(
destination_origin,
privacy_sandbox::PrivacySandboxAttestationsGatedAPI::
kProtectedAudience);
}
} else if (invoking_api ==
content::PrivacySandboxInvokingAPI::kSharedStorage) {
return privacy_sandbox_settings->IsEventReportingDestinationAttested(
destination_origin,
privacy_sandbox::PrivacySandboxAttestationsGatedAPI::kSharedStorage);
privacy_sandbox::PrivacySandboxAttestationsGatedAPI gated_api;
switch (invoking_api) {
case content::PrivacySandboxInvokingAPI::kProtectedAudience:
gated_api = privacy_sandbox::PrivacySandboxAttestationsGatedAPI::
kProtectedAudience;
break;
case content::PrivacySandboxInvokingAPI::kSharedStorage:
gated_api =
privacy_sandbox::PrivacySandboxAttestationsGatedAPI::kSharedStorage;
break;
}
return false;
return privacy_sandbox_settings->IsEventReportingDestinationAttested(
destination_origin, gated_api);
}
void ChromeContentBrowserClient::OnAuctionComplete(
@@ -3741,6 +3698,18 @@ bool ChromeContentBrowserClient::IsFullCookieAccessAllowed(
content::WebContents* web_contents,
const GURL& url,
const blink::StorageKey& storage_key) {
return dips_move::IsFullCookieAccessAllowed(browser_context, web_contents,
url, storage_key);
}
// TODO: crbug.com/369813097 - Move this implementation into
// ChromeContentBrowserClient::IsFullCookieAccessAllowed() after DIPS migrates
// to //content.
namespace dips_move {
bool IsFullCookieAccessAllowed(content::BrowserContext* browser_context,
content::WebContents* web_contents,
const GURL& url,
const blink::StorageKey& storage_key) {
Profile* profile = Profile::FromBrowserContext(browser_context);
scoped_refptr<content_settings::CookieSettings> cookie_settings =
CookieSettingsFactory::GetForProfile(profile);
@@ -3752,6 +3721,39 @@ bool ChromeContentBrowserClient::IsFullCookieAccessAllowed(
url::Origin::Create(storage_key.top_level_site().GetURL()),
cookie_settings->SettingOverridesForStorage());
}
} // namespace dips_move
void ChromeContentBrowserClient::GrantCookieAccessDueToHeuristic(
content::BrowserContext* browser_context,
const net::SchemefulSite& top_frame_site,
const net::SchemefulSite& accessing_site,
base::TimeDelta ttl,
bool ignore_schemes) {
dips_move::GrantCookieAccessDueToHeuristic(
browser_context, top_frame_site, accessing_site, ttl, ignore_schemes);
}
// TODO: crbug.com/369813097 - Move this implementation into
// ChromeContentBrowserClient::GrantCookieAccessDueToHeuristic() after DIPS
// migrates to //content.
namespace dips_move {
void GrantCookieAccessDueToHeuristic(content::BrowserContext* browser_context,
const net::SchemefulSite& top_frame_site,
const net::SchemefulSite& accessing_site,
base::TimeDelta ttl,
bool ignore_schemes) {
scoped_refptr<content_settings::CookieSettings> cookie_settings =
CookieSettingsFactory::GetForProfile(
Profile::FromBrowserContext(browser_context));
if (!cookie_settings) {
return;
}
cookie_settings->SetTemporaryCookieGrantForHeuristic(
accessing_site.GetURL(), top_frame_site.GetURL(), ttl,
/*use_schemeless_patterns=*/ignore_schemes);
}
} // namespace dips_move
#if BUILDFLAG(IS_CHROMEOS)
void ChromeContentBrowserClient::OnTrustAnchorUsed(
@@ -4515,6 +4517,9 @@ void ChromeContentBrowserClient::OverrideWebkitPrefs(
delegate->IsForceDarkWebContentEnabled();
web_prefs->modal_context_menu = delegate->IsModalContextMenu();
web_prefs->dynamic_safe_area_insets_enabled =
delegate->IsDynamicSafeAreaInsetsEnabled();
}
#endif // BUILDFLAG(IS_ANDROID)
@@ -4981,13 +4986,12 @@ void ChromeContentBrowserClient::GetAdditionalMappedFilesForChildProcess(
// BUILDFLAG(IS_CHROMEOS)
#if BUILDFLAG(IS_CHROMEOS_LACROS)
// Map startup and post-login parameter files to child processes in Lacros.
// Map startup parameter files to child processes in Lacros.
// The FD numbers are passed via command line switches in
// |AppendExtraCommandLineSwitches|.
//
// NOTE: the Zygote process requires special handling.
// It doesn't need the post-login parameters, so it can be fully launched at
// login screen. Also, serializing startup data early in the initialization
// Serializing startup data early in the initialization
// process requires temporarily initializing Mojo. That's handled in the
// |LaunchZygoteHelper| function in |content_main_runner_impl.cc|. Here, we
// deal with all other type of processes.
@@ -5001,17 +5005,6 @@ void ChromeContentBrowserClient::GetAdditionalMappedFilesForChildProcess(
kCrosStartupDataDescriptor + base::GlobalDescriptors::kBaseDescriptor;
mappings->Transfer(kStartupDataFD, std::move(cros_startup_fd));
}
if (chromeos::IsLaunchedWithPostLoginParams()) {
base::ScopedFD cros_postlogin_fd =
chromeos::BrowserPostLoginParams::CreatePostLoginData();
if (cros_postlogin_fd.is_valid()) {
constexpr int kPostLoginDataFD =
kCrosPostLoginDataDescriptor +
base::GlobalDescriptors::kBaseDescriptor;
mappings->Transfer(kPostLoginDataFD, std::move(cros_postlogin_fd));
}
}
}
#endif // BUILDFLAG(IS_CHROMEOS_LACROS)
}
@@ -5063,9 +5056,6 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
return std::wstring();
case sandbox::mojom::Sandbox::kOnDeviceModelExecution:
return std::wstring();
#if BUILDFLAG(ENABLE_PPAPI)
case sandbox::mojom::Sandbox::kPpapi:
#endif
case sandbox::mojom::Sandbox::kNoSandbox:
case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
case sandbox::mojom::Sandbox::kXrCompositing:
@@ -5077,7 +5067,9 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
case sandbox::mojom::Sandbox::kPrintCompositor:
case sandbox::mojom::Sandbox::kAudio:
case sandbox::mojom::Sandbox::kScreenAI:
#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC)
case sandbox::mojom::Sandbox::kVideoEffects:
#endif
case sandbox::mojom::Sandbox::kSpeechRecognition:
case sandbox::mojom::Sandbox::kPdfConversion:
case sandbox::mojom::Sandbox::kService:
@@ -5180,7 +5172,9 @@ bool ChromeContentBrowserClient::PreSpawnChild(
#if !BUILDFLAG(IS_ANDROID)
case sandbox::mojom::Sandbox::kScreenAI:
#endif
#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC)
case sandbox::mojom::Sandbox::kVideoEffects:
#endif
case sandbox::mojom::Sandbox::kAudio:
case sandbox::mojom::Sandbox::kOnDeviceModelExecution:
case sandbox::mojom::Sandbox::kSpeechRecognition:
@@ -5441,6 +5435,13 @@ ChromeContentBrowserClient::CreateThrottlesForNavigation(
if (url_to_apps_throttle) {
throttles.push_back(std::move(url_to_apps_throttle));
}
std::unique_ptr<content::NavigationThrottle>
navigation_capturing_redirection_throttle =
web_app::NavigationCapturingRedirectionThrottle::MaybeCreate(handle);
if (navigation_capturing_redirection_throttle) {
throttles.push_back(std::move(navigation_capturing_redirection_throttle));
}
#endif // !BUILDFLAG(IS_ANDROID)
Profile* profile = Profile::FromBrowserContext(
@@ -5541,6 +5542,9 @@ ChromeContentBrowserClient::CreateThrottlesForNavigation(
profile_management::OidcAuthResponseCaptureNavigationThrottle::
MaybeCreateThrottleFor(handle),
&throttles);
MaybeAddThrottle(
ManagedProfileRequiredNavigationThrottle::MaybeCreateThrottleFor(handle),
&throttles);
#endif // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN)
#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || \
@@ -6249,7 +6253,8 @@ ChromeContentBrowserClient::CreateNonNetworkNavigationURLLoaderFactory(
AreExtensionsDisabledForProfile(browser_context)) {
bool is_guest = false;
#if BUILDFLAG(ENABLE_GUEST_VIEW)
is_guest = !!extensions::WebViewGuest::FromWebContents(web_contents);
is_guest =
!!extensions::WebViewGuest::FromFrameTreeNodeId(frame_tree_node_id);
#endif
return extensions::CreateExtensionNavigationURLLoaderFactory(
@@ -7107,7 +7112,8 @@ ChromeContentBrowserClient::CreateLoginDelegate(
content::WebContents* web_contents,
content::BrowserContext* browser_context,
const content::GlobalRequestID& request_id,
bool is_request_for_primary_main_frame,
bool is_request_for_primary_main_frame_navigation,
bool is_request_for_navigation,
const GURL& url,
scoped_refptr<net::HttpResponseHeaders> response_headers,
bool first_auth_attempt,
@@ -7157,8 +7163,8 @@ ChromeContentBrowserClient::CreateLoginDelegate(
// ash-chrome.
return http_auth_coordinator_->CreateLoginDelegate(
web_contents, browser_context, auth_info, request_id,
is_request_for_primary_main_frame, url, response_headers,
std::move(auth_required_callback));
is_request_for_primary_main_frame_navigation, is_request_for_navigation,
url, response_headers, std::move(auth_required_callback));
}
bool ChromeContentBrowserClient::HandleExternalProtocol(
@@ -7173,6 +7179,7 @@ bool ChromeContentBrowserClient::HandleExternalProtocol(
bool has_user_gesture,
const std::optional<url::Origin>& initiating_origin,
content::RenderFrameHost* initiator_document,
const net::IsolationInfo& isolation_info,
mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory) {
CHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
@@ -7255,7 +7262,9 @@ bool ChromeContentBrowserClient::HandleWebUI(
Profile* profile = Profile::FromBrowserContext(browser_context);
auto* tracking_protection_settings =
TrackingProtectionSettingsFactory::GetForProfile(profile);
if (tracking_protection_settings &&
if (base::FeatureList::IsEnabled(
privacy_sandbox::kTrackingProtection3pcdUx) &&
tracking_protection_settings &&
tracking_protection_settings->IsTrackingProtection3pcdEnabled()) {
// Redirect from cookies to trackingProtection in experiment.
if (url->SchemeIs(content::kChromeUIScheme) &&
@@ -7483,7 +7492,7 @@ ChromeContentBrowserClient::GetAsyncCheckTracker(
void ChromeContentBrowserClient::ReportLegacyTechEvent(
content::RenderFrameHost* render_frame_host,
const std::string type,
const std::string& type,
const GURL& url,
const GURL& frame_url,
const std::string& filename,
@@ -7903,8 +7912,12 @@ void ChromeContentBrowserClient::IsClipboardCopyAllowedByPolicy(
ClipboardRestrictionService* service =
ClipboardRestrictionServiceFactory::GetInstance()->GetForBrowserContext(
source.browser_context());
if (service->IsUrlAllowedToCopy(*source.data_transfer_endpoint()->GetURL(),
metadata.size.value_or(0),
GURL url = source.data_transfer_endpoint() &&
source.data_transfer_endpoint()->IsUrlType() &&
source.data_transfer_endpoint()->GetURL()
? *source.data_transfer_endpoint()->GetURL()
: GURL();
if (service->IsUrlAllowedToCopy(std::move(url), metadata.size.value_or(0),
&replacement_data)) {
std::move(callback).Run(metadata.format_type, data, std::nullopt);
} else {
@@ -8133,6 +8146,16 @@ bool ChromeContentBrowserClient::SetupEmbedderSandboxParameters(
}
return compiler->SetParameter(sandbox::policy::kParamScreenAiComponentPath,
screen_ai_binary_path.value());
} else if (sandbox_type == sandbox::mojom::Sandbox::kOnDeviceTranslation) {
auto translatekit_binary_path =
OnDeviceTranslationServiceController::GetTranslateKitComponentPath();
if (translatekit_binary_path.empty()) {
VLOG(1) << "TranslationKit component not found.";
return false;
}
return compiler->SetParameter(
sandbox::policy::kParamTranslatekitComponentPath,
translatekit_binary_path.value());
}
return false;
@@ -8683,7 +8706,7 @@ void ChromeContentBrowserClient::NotifyMultiCaptureStateChanged(
std::unique_ptr<content::DipsDelegate>
ChromeContentBrowserClient::CreateDipsDelegate() {
return std::make_unique<ChromeDipsDelegate>();
return ChromeDipsDelegate::Create();
}
bool ChromeContentBrowserClient::ShouldSuppressAXLoadComplete(
@@ -8781,7 +8804,84 @@ bool ChromeContentBrowserClient::IsSaveableNavigation(
return tab_groups::TabGroupSyncUtils::IsSaveableNavigation(navigation_handle);
}
#if BUILDFLAG(IS_WIN)
void ChromeContentBrowserClient::OnUiaProviderRequested(
bool uia_provider_enabled) {
if (handled_uia_provider_request_) {
return;
}
handled_uia_provider_request_ = true;
if (features::kUiaProvider.default_state ==
base::FEATURE_ENABLED_BY_DEFAULT) {
// Do nothing if the feature has launched.
// TODO: Remove all code relating to this synthetic field trial.
return;
}
// The "Control_NNNN" and "Enabled_NNNN" groups in the UiaProviderWin study
// are equal-sized arms for which the UiaProvider feature is disabled and
// enabled, respectively. (The feature may also be disabled in other groups,
// such as "Default_NNNN" or preperiod groups.) Analyzing data from users in
// these two groups alone does not provide an accurate picture of the impact
// of the feature, because the browser must check whether or not the feature
// is enable during startup regardless of whether or not a UI automation
// client connects to the browser. Filtering data by whether or not
// accessibility is enabled is also insufficient, as this will include
// browsers for which an MSAA/IAccessible2 client connects. To measure the
// impact of the UiaProvider feature, we only want to consider clients where a
// UI automation client connected and said connection was either refused
// because the client is in the control group, or was accepted because the
// client is in the enabled group. We do this by enrolling the client in one
// of two groups of a synthetic field trial in only these two situations.
if (auto* trial = base::FeatureList::GetFieldTrial(features::kUiaProvider)) {
static constexpr std::string_view kControl = "Control";
static constexpr std::string_view kEnabled = "Enabled";
const auto& trial_group_name = trial->GetGroupNameWithoutActivation();
std::string_view group_name;
if (base::StartsWith(trial_group_name, "Control")) {
group_name = kControl;
} else if (base::StartsWith(trial_group_name, "Enabled")) {
group_name = kEnabled;
}
if (!group_name.empty()) {
ChromeMetricsServiceAccessor::RegisterSyntheticFieldTrial(
"UiaProviderActiveSynthetic", group_name,
variations::SyntheticTrialAnnotationMode::kCurrentLog);
}
}
}
#endif // BUILDFLAG(IS_WIN)
void ChromeContentBrowserClient::SetSamplingProfiler(
std::unique_ptr<MainThreadStackSamplingProfiler> sampling_profiler) {
sampling_profiler_ = std::move(sampling_profiler);
}
base::ReadOnlySharedMemoryRegion
ChromeContentBrowserClient::GetPerformanceScenarioRegionForProcess(
content::RenderProcessHost* process_host) {
return performance_manager::GetSharedScenarioRegionForProcess(process_host);
}
base::ReadOnlySharedMemoryRegion
ChromeContentBrowserClient::GetGlobalPerformanceScenarioRegion() {
return performance_manager::GetGlobalSharedScenarioRegion();
}
bool ChromeContentBrowserClient::ShouldDispatchPagehideDuringCommit(
content::BrowserContext* browser_context,
const GURL& destination_url) {
if (!base::FeatureList::IsEnabled(kSkipPagehideInCommitForDSENavigation)) {
return true;
}
auto* template_url_service = TemplateURLServiceFactory::GetForProfile(
Profile::FromBrowserContext(browser_context));
// Allow not dispatching pagehide during commit when navigating to a DSE
// results page, to prioritize committing that page instead of running
// events on the previous page.
return !template_url_service ||
!template_url_service->IsSearchResultsPageFromDefaultSearchProvider(
destination_url);
}
tools/under-control/src/chrome/browser/prefs/browser_prefs.cc
+123 -19
View File
@@ -114,7 +114,6 @@
#include "components/autofill/core/common/autofill_prefs.h"
#include "components/blocked_content/safe_browsing_triggered_popup_blocker.h"
#include "components/breadcrumbs/core/breadcrumbs_status.h"
#include "components/browser_sync/sync_to_signin_migration.h"
#include "components/browsing_data/core/pref_names.h"
#include "components/certificate_transparency/pref_names.h"
#include "components/commerce/core/pref_names.h"
@@ -169,7 +168,7 @@
#include "components/proxy_config/pref_proxy_config_tracker_impl.h"
#include "components/safe_browsing/content/common/file_type_policies_prefs.h"
#include "components/safe_browsing/core/common/safe_browsing_prefs.h"
#include "components/saved_tab_groups/pref_names.h"
#include "components/saved_tab_groups/public/pref_names.h"
#include "components/search_engines/search_engine_choice/search_engine_choice_service.h"
#include "components/search_engines/template_url_prepopulate_data.h"
#include "components/security_interstitials/content/insecure_form_blocking_page.h"
@@ -226,11 +225,11 @@
#include "extensions/browser/api/audio/audio_api.h"
#include "extensions/browser/api/runtime/runtime_api.h"
#if BUILDFLAG(IS_CHROMEOS_ASH)
#include "chrome/browser/ash/crosapi/browser_data_migrator.h"
#include "chrome/browser/ash/device_name/device_name_store.h"
#include "chrome/browser/ash/extensions/extensions_permissions_tracker.h"
#include "chrome/browser/ash/kerberos/kerberos_credentials_manager.h"
#include "chrome/browser/ash/net/system_proxy_manager.h"
#include "chrome/browser/ash/performance/doze_mode_power_status_scheduler.h"
#include "chrome/browser/ash/platform_keys/key_permissions/key_permissions_manager_impl.h"
#include "chrome/browser/ash/policy/networking/euicc_status_uploader.h"
#include "chrome/browser/ash/policy/remote_commands/crd/crd_admin_session_controller.h"
@@ -289,6 +288,7 @@
#include "chrome/browser/new_tab_page/promos/promo_service.h"
#include "chrome/browser/on_device_translation/pref_names.h"
#include "chrome/browser/policy/developer_tools_policy_handler.h"
#include "chrome/browser/promos/promos_utils.h"
#include "chrome/browser/screen_ai/pref_names.h"
#include "chrome/browser/search/background/ntp_custom_background_service.h"
#include "chrome/browser/search_engine_choice/search_engine_choice_dialog_service.h"
@@ -317,10 +317,6 @@
#include "chrome/browser/ui/webui/whats_new/whats_new_ui.h"
#endif
#if !BUILDFLAG(IS_ANDROID) && BUILDFLAG(GOOGLE_CHROME_BRANDING)
#include "chrome/browser/promos/promos_utils.h"
#endif // !BUILDFLAG(IS_ANDROID) && BUILDFLAG(GOOGLE_CHROME_BRANDING)
#if BUILDFLAG(IS_CHROMEOS)
#include "chrome/browser/chromeos/extensions/echo_private/echo_private_api.h"
#include "chrome/browser/chromeos/extensions/login_screen/login/login_api_prefs.h"
@@ -441,6 +437,7 @@
#include "chrome/browser/ui/webui/settings/reset_settings_handler.h"
#include "chrome/browser/upgrade_detector/upgrade_detector_chromeos.h"
#include "chromeos/ash/components/audio/audio_devices_pref_handler_impl.h"
#include "chromeos/ash/components/boca/on_task/on_task_prefs.h"
#include "chromeos/ash/components/local_search_service/search_metrics_reporter.h"
#include "chromeos/ash/components/network/cellular_esim_profile_handler_impl.h"
#include "chromeos/ash/components/network/cellular_metrics_logger.h"
@@ -462,7 +459,7 @@
#include "components/account_manager_core/chromeos/account_manager.h"
#include "components/onc/onc_pref_names.h"
#include "components/quirks/quirks_manager.h"
#include "components/user_manager/user_manager_base.h"
#include "components/user_manager/user_manager_impl.h"
#include "extensions/browser/api/lock_screen_data/lock_screen_item_storage.h"
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
@@ -1085,12 +1082,54 @@ constexpr char kPasswordGenerationNudgePasswordDismissCount[] =
"password_generation_nudge_password_dismiss_count";
#endif // !BUILDFLAG(IS_ANDROID)
// Deprecated 09/2024
#if !BUILDFLAG(IS_ANDROID)
const char kTranslateKitRootDir[] =
"on_device_translation.translate_kit_root_dir";
#endif
// Deprecated 09/2024
#if BUILDFLAG(IS_ANDROID)
constexpr char kPrivacySandboxActivityTypeRecord[] =
"privacy_sandbox.activity_type.record";
#endif // BUILDFLAG(IS_ANDROID)
// Deprecated 09/2024.
#if !BUILDFLAG(IS_ANDROID)
const char kTabResumeDismissedTabsPrefName[] =
"NewTabPage.MostRelevantTabResumption.DismissedTabs";
#endif // !BUILDFLAG(IS_ANDROID)
// Deprecated 10/2024.
#if BUILDFLAG(IS_CHROMEOS)
const char kMigrationStep[] = "ash.browser_data_migrator.migration_step";
const char kMoveMigrationResumeStepPref[] =
"ash.browser_data_migrator.move_migration_resume_step";
const char kMoveMigrationResumeCountPref[] =
"ash.browser_data_migrator.move_migration_resume_count";
const char kLacrosSecondaryProfilesAllowed[] =
"lacros_secondary_profiles_allowed";
#endif
#if !BUILDFLAG(IS_ANDROID)
// Deprecated 10/2024
// Pref name for the percent threshold to show HaTS on the What's New page.
inline constexpr char kWhatsNewHatsActivationThreshold[] =
"browser.whats_new_hats_activation_threshold";
#endif
#if BUILDFLAG(IS_CHROMEOS_ASH)
// Deprecated 10/2024
// An integer pref which determines how much FaceGaze should smooth cursor
// movements.
inline constexpr char kAccessibilityFaceGazeCursorSmoothing[] =
"settings.a11y.face_gaze.cursor_smoothing";
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
// Deprecated 10/2024.
const char kBeforeunloadEventCancelByPreventDefaultEnabled[] =
"policy.beforeunload_event_cancel_by_prevent_default_enabled";
// Register local state used only for migration (clearing or moving to a new
// key).
void RegisterLocalStatePrefsForMigration(PrefRegistrySimple* registry) {
@@ -1185,6 +1224,22 @@ void RegisterLocalStatePrefsForMigration(PrefRegistrySimple* registry) {
registry->RegisterBooleanPref(kDemoModeResourcesRemoved, false);
registry->RegisterIntegerPref(kAccumulatedUsagePref, 0);
#endif
#if BUILDFLAG(IS_CHROMEOS)
// Deprecated 10/2024.
registry->RegisterIntegerPref(kMigrationStep, 0);
registry->RegisterDictionaryPref(kMoveMigrationResumeStepPref);
registry->RegisterDictionaryPref(kMoveMigrationResumeCountPref);
#endif
#if !BUILDFLAG(IS_ANDROID)
// Deprecated 10/2024
registry->RegisterIntegerPref(kWhatsNewHatsActivationThreshold, 100);
#endif
// Deprecated 10/2024.
registry->RegisterBooleanPref(kBeforeunloadEventCancelByPreventDefaultEnabled,
true);
}
// Register prefs used only for migration (clearing or moving to a new key).
@@ -1525,11 +1580,31 @@ void RegisterProfilePrefsForMigration(
0);
#endif // !BUILDFLAG(IS_ANDROID)
// Deprecated 09/2024.
#if !BUILDFLAG(IS_ANDROID)
registry->RegisterFilePathPref(kTranslateKitRootDir, base::FilePath());
#endif
// Deprecated 09/2024
#if BUILDFLAG(IS_ANDROID)
registry->RegisterListPref(kPrivacySandboxActivityTypeRecord);
#endif // BUILDFLAG(IS_ANDROID)
// Deprecated 09/2024
#if !BUILDFLAG(IS_ANDROID)
registry->RegisterListPref(kTabResumeDismissedTabsPrefName,
base::Value::List());
#endif // !BUILDFLAG(IS_ANDROID)
// Deprecated 10/2024
#if BUILDFLAG(IS_CHROMEOS)
registry->RegisterBooleanPref(kLacrosSecondaryProfilesAllowed, true);
#endif // BUILDFLAG(IS_CHROMEOS)
#if BUILDFLAG(IS_CHROMEOS_ASH)
// Deprecated 10/2024
registry->RegisterIntegerPref(kAccessibilityFaceGazeCursorSmoothing, 7);
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
}
void ClearSyncRequestedPrefAndMaybeMigrate(PrefService* profile_prefs) {
@@ -1695,10 +1770,9 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
ash::CellularESimProfileHandlerImpl::RegisterLocalStatePrefs(registry);
ash::ManagedCellularPrefHandler::RegisterLocalStatePrefs(registry);
ash::ChromeSessionManager::RegisterPrefs(registry);
user_manager::UserManagerBase::RegisterPrefs(registry);
user_manager::UserManagerImpl::RegisterPrefs(registry);
crosapi::browser_util::RegisterLocalStatePrefs(registry);
ash::CupsPrintersManager::RegisterLocalStatePrefs(registry);
ash::BrowserDataMigratorImpl::RegisterLocalStatePrefs(registry);
ash::bluetooth_config::BluetoothPowerControllerImpl::RegisterLocalStatePrefs(
registry);
ash::bluetooth_config::DeviceNameManagerImpl::RegisterLocalStatePrefs(
@@ -1706,6 +1780,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
ash::DemoSession::RegisterLocalStatePrefs(registry);
ash::DemoSetupController::RegisterLocalStatePrefs(registry);
ash::DeviceNameStore::RegisterLocalStatePrefs(registry);
ash::DozeModePowerStatusScheduler::RegisterLocalStatePrefs(registry);
chromeos::DeviceOAuth2TokenStoreChromeOS::RegisterPrefs(registry);
ash::device_settings_cache::RegisterPrefs(registry);
ash::EnableAdbSideloadingScreen::RegisterPrefs(registry);
@@ -1971,10 +2046,6 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
omnibox::RegisterProfilePrefs(registry);
ZeroSuggestProvider::RegisterProfilePrefs(registry);
#if !BUILDFLAG(IS_ANDROID) && BUILDFLAG(GOOGLE_CHROME_BRANDING)
promos_utils::RegisterProfilePrefs(registry);
#endif // !BUILDFLAG(IS_ANDROID) && BUILDFLAG(GOOGLE_CHROME_BRANDING)
#if BUILDFLAG(ENABLE_SESSION_SERVICE)
RegisterSessionServiceLogProfilePrefs(registry);
SessionDataService::RegisterProfilePrefs(registry);
@@ -2062,6 +2133,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
ntp_tiles::CustomLinksManagerImpl::RegisterProfilePrefs(registry);
PinnedTabCodec::RegisterProfilePrefs(registry);
policy::DeveloperToolsPolicyHandler::RegisterProfilePrefs(registry);
promos_utils::RegisterProfilePrefs(registry);
PromoService::RegisterProfilePrefs(registry);
RegisterReadAnythingProfilePrefs(registry);
settings::SettingsUI::RegisterProfilePrefs(registry);
@@ -2135,7 +2207,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
ash::bluetooth_config::BluetoothPowerControllerImpl::RegisterProfilePrefs(
registry);
ash::HatsBluetoothRevampTriggerImpl::RegisterProfilePrefs(registry);
user_manager::UserManagerBase::RegisterProfilePrefs(registry);
user_manager::UserManagerImpl::RegisterProfilePrefs(registry);
ash::ClientAppMetadataProviderService::RegisterProfilePrefs(registry);
ash::CupsPrintersManager::RegisterProfilePrefs(registry);
ash::device_sync::RegisterProfilePrefs(registry);
@@ -2196,6 +2268,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
wallpaper_handlers::prefs::RegisterProfilePrefs(registry);
ash::reporting::RegisterProfilePrefs(registry);
ChromeMediaAppGuestUIDelegate::RegisterProfilePrefs(registry);
ash::boca::RegisterOnTaskProfilePrefs(registry);
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
#if BUILDFLAG(IS_CHROMEOS_LACROS)
@@ -2442,6 +2515,21 @@ void MigrateObsoleteLocalStatePrefs(PrefService* local_state) {
local_state->ClearPref(kAccumulatedUsagePref);
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
// Added 10/2024
#if BUILDFLAG(IS_CHROMEOS)
local_state->ClearPref(kMigrationStep);
local_state->ClearPref(kMoveMigrationResumeStepPref);
local_state->ClearPref(kMoveMigrationResumeCountPref);
#endif
#if !BUILDFLAG(IS_ANDROID)
// Added 10/2024
local_state->ClearPref(kWhatsNewHatsActivationThreshold);
#endif
// Added 10/2024.
local_state->ClearPref(kBeforeunloadEventCancelByPreventDefaultEnabled);
// Please don't delete the following line. It is used by PRESUBMIT.py.
// END_MIGRATE_OBSOLETE_LOCAL_STATE_PREFS
@@ -2687,10 +2775,6 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
// Added 03/2024.
profile_prefs->ClearPref(kDefaultSearchProviderChoicePendingDeprecated);
// Added 02/2024, but DO NOT REMOVE after the usual year!
// TODO(crbug.com/40282890): Remove ~one year after full launch.
browser_sync::MaybeMigrateSyncingUserToSignedIn(profile_path, profile_prefs);
// Added 03/2024.
profile_prefs->ClearPref(kShowInternalAccessibilityTree);
@@ -2858,11 +2942,31 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
profile_prefs->ClearPref(kPasswordGenerationNudgePasswordDismissCount);
#endif // !BUILDFLAG(IS_ANDROID)
// Added 09/2024.
#if !BUILDFLAG(IS_ANDROID)
profile_prefs->ClearPref(kTranslateKitRootDir);
#endif
// Added 09/2024
#if BUILDFLAG(IS_ANDROID)
profile_prefs->ClearPref(kPrivacySandboxActivityTypeRecord);
#endif // BUILDFLAG(IS_ANDROID)
// Added 09/2024
#if !BUILDFLAG(IS_ANDROID)
profile_prefs->ClearPref(kTabResumeDismissedTabsPrefName);
#endif // !BUILDFLAG(IS_ANDROID)
// Added 10/2024
#if BUILDFLAG(IS_CHROMEOS)
profile_prefs->ClearPref(kLacrosSecondaryProfilesAllowed);
#endif // BUILDFLAG(IS_CHROMEOS)
#if BUILDFLAG(IS_CHROMEOS_ASH)
// Added 10/2024
profile_prefs->ClearPref(kAccessibilityFaceGazeCursorSmoothing);
#endif // BUILDFLAG(IS_CHROMEOS_ASH)
// Please don't delete the following line. It is used by PRESUBMIT.py.
// END_MIGRATE_OBSOLETE_PROFILE_PREFS
tools/under-control/src/chrome/browser/ui/tab_helpers.cc
+4 -5
View File
@@ -28,7 +28,7 @@
#include "chrome/browser/content_settings/page_specific_content_settings_delegate.h"
#include "chrome/browser/content_settings/sound_content_setting_observer.h"
#include "chrome/browser/dips/dips_bounce_detector.h"
#include "chrome/browser/dips/dips_service.h"
#include "chrome/browser/dips/dips_navigation_flow_detector.h"
#include "chrome/browser/external_protocol/external_protocol_observer.h"
#include "chrome/browser/favicon/favicon_utils.h"
#include "chrome/browser/file_system_access/file_system_access_features.h"
@@ -179,7 +179,6 @@
#include "chrome/browser/android/policy/policy_auditor_bridge.h"
#include "chrome/browser/banners/android/chrome_app_banner_manager_android.h"
#include "chrome/browser/content_settings/request_desktop_site_web_contents_observer_android.h"
#include "chrome/browser/dips/dips_navigation_flow_detector.h"
#include "chrome/browser/facilitated_payments/ui/chrome_facilitated_payments_client.h"
#include "chrome/browser/fast_checkout/fast_checkout_tab_helper.h"
#include "chrome/browser/flags/android/chrome_feature_list.h"
@@ -225,6 +224,7 @@
#if BUILDFLAG(IS_CHROMEOS_ASH)
#include "chrome/browser/ash/boot_times_recorder/boot_times_recorder_tab_helper.h"
#include "chrome/browser/ash/growth/campaigns_manager_session_tab_helper.h"
#include "chrome/browser/ash/mahi/web_contents/mahi_tab_helper.h"
#include "chrome/browser/ui/ash/google_one/google_one_offer_iph_tab_helper.h"
#endif
@@ -235,7 +235,6 @@
#if BUILDFLAG(IS_CHROMEOS)
#include "chrome/browser/chromeos/container_app/container_app_tab_helper.h"
#include "chrome/browser/chromeos/cros_apps/cros_apps_tab_helper.h"
#include "chrome/browser/chromeos/mahi/mahi_tab_helper.h"
#include "chrome/browser/chromeos/policy/dlp/dlp_content_tab_helper.h"
#include "chrome/browser/chromeos/printing/print_preview/printing_init_cros.h"
#endif
@@ -388,7 +387,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
}
browsing_topics::BrowsingTopicsRedirectObserver::MaybeCreateForWebContents(
web_contents);
chrome::ChainedBackNavigationTracker::CreateForWebContents(web_contents);
ChainedBackNavigationTracker::CreateForWebContents(web_contents);
chrome_browser_net::NetErrorTabHelper::CreateForWebContents(web_contents);
if (!autofill_client_provider.uses_platform_autofill()) {
ChromePasswordManagerClient::CreateForWebContents(web_contents);
@@ -409,6 +408,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
ISOLATED_WORLD_ID_CHROME_INTERNAL);
ConnectionHelpTabHelper::CreateForWebContents(web_contents);
CoreTabHelper::CreateForWebContents(web_contents);
DipsNavigationFlowDetector::CreateForWebContents(web_contents);
DIPSWebContentsObserver::MaybeCreateForWebContents(web_contents);
#if BUILDFLAG(ENABLE_REPORTING)
if (base::FeatureList::IsEnabled(
@@ -597,7 +597,6 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
// --- Section 2: Platform-specific tab helpers ---
#if BUILDFLAG(IS_ANDROID)
DipsNavigationFlowDetector::MaybeCreateForWebContents(web_contents);
webapps::MLInstallabilityPromoter::CreateForWebContents(web_contents);
{
// Remove after fixing https://crbug/905919
tools/under-control/src/chrome/common/extensions/api/autofill_private.idl
+24
View File
@@ -284,6 +284,9 @@ namespace autofillPrivate {
// Globally unique identifier for this entry.
DOMString? guid;
// The IBAN's instrument ID from the GPay server, if applicable.
DOMString? instrumentId;
// IBAN value.
DOMString? value;
@@ -311,6 +314,9 @@ namespace autofillPrivate {
callback GetCreditCardCallback = void(optional CreditCardEntry card);
callback CheckForDeviceAuthCallback = void(boolean isDeviceAuthAvailable);
callback GetUserAnnotationsEntriesCallback = void(UserAnnotationsEntry[] items);
callback hasUserAnnotationsEntriesCallback = void(boolean hasEntries);
callback isUserEligibleForAutofillImprovementsCallback = void(boolean eligible);
callback annotationsBootstrappingCallback = void(boolean bootstrapped);
interface Functions {
// Gets currently signed-in user profile info, no value is returned if
@@ -382,6 +388,9 @@ namespace autofillPrivate {
// Logs that the server cards edit link was clicked.
static void logServerCardLinkClicked();
// Logs that a serve IBAN's edit link was clicked.
static void logServerIbanLinkClicked();
// Enrolls a credit card into virtual cards.
// |cardId|: The server side id of the credit card to be enrolled. Note it
// refers to the legacy server id of credit cards, not the instrument ids.
@@ -421,11 +430,26 @@ namespace autofillPrivate {
static void getUserAnnotationsEntries(
GetUserAnnotationsEntriesCallback callback);
// Returns if there are any saved user annotations entries.
static void hasUserAnnotationsEntries(
hasUserAnnotationsEntriesCallback callback);
// Returns if the user is eligible for autofill improvements.
static void isUserEligibleForAutofillImprovements(
isUserEligibleForAutofillImprovementsCallback callback);
// Deletes the user annotations entry by its id.
static void deleteUserAnnotationsEntry(long entryId);
// Deletes all user annotations entries.
static void deleteAllUserAnnotationsEntries();
// Notifies autofill client about the prediction improvements pre changing.
static void predictionImprovementsIphFeatureUsed();
// Triggers bootstrapping of user annotations. Returns true if
// bootstrapping was successful (entries were added), false otherwise.
static void triggerAnnotationsBootstrapping(annotationsBootstrappingCallback callback);
};
interface Events {
tools/under-control/src/chrome/common/extensions/api/enterprise_platform_keys.idl
+12 -13
View File
@@ -90,7 +90,6 @@ namespace enterprise.platformKeys {
Scope scope;
};
interface Functions {
// Returns the available Tokens. In a regular user's session the list will
// always contain the user's token with <code>id</code> <code>"user"</code>.
@@ -135,19 +134,19 @@ namespace enterprise.platformKeys {
// <code>challengeUserKey</code>, but allows specifying the algorithm of a
// registered key. Challenges a hardware-backed Enterprise Machine Key and
// emits the response as part of a remote attestation protocol. Only useful
// on Chrome OS and in conjunction with the Verified Access Web API which
// on ChromeOS and in conjunction with the Verified Access Web API which
// both issues challenges and verifies responses.
//
// A successful verification by the Verified Access Web API is a strong
// signal that the current device is a legitimate Chrome OS device, the
// signal that the current device is a legitimate ChromeOS device, the
// current device is managed by the domain specified during verification,
// the current signed-in user is managed by the domain specified during
// verification, and the current device state complies with enterprise
// device policy. For example, a policy may specify that the device must not
// be in developer mode. Any device identity emitted by the verification is
// be in developer mode. Any device identity emitted by the verification is
// tightly bound to the hardware of the current device. If
// <code>"user"</code> Scope is specified, the identity is also tighly bound
// to the current signed-in user.
// <code>"user"</code> Scope is specified, the identity is also tightly
// bound to the current signed-in user.
//
// This function is highly restricted and will fail if the current device is
// not managed, the current user is not managed, or if this operation has
@@ -161,11 +160,11 @@ namespace enterprise.platformKeys {
ChallengeCallback callback);
// Challenges a hardware-backed Enterprise Machine Key and emits the
// response as part of a remote attestation protocol. Only useful on Chrome
// OS and in conjunction with the Verified Access Web API which both issues
// challenges and verifies responses. A successful verification by the
// Verified Access Web API is a strong signal of all of the following:
// * The current device is a legitimate Chrome OS device.
// response as part of a remote attestation protocol. Only useful on
// ChromeOS and in conjunction with the Verified Access Web API which both
// issues challenges and verifies responses. A successful verification by
// the Verified Access Web API is a strong signal of all of the following:
// * The current device is a legitimate ChromeOS device.
// * The current device is managed by the domain specified during
// verification.
// * The current signed-in user is managed by the domain specified during
@@ -195,11 +194,11 @@ namespace enterprise.platformKeys {
ChallengeCallback callback);
// Challenges a hardware-backed Enterprise User Key and emits the response
// as part of a remote attestation protocol. Only useful on Chrome OS and in
// as part of a remote attestation protocol. Only useful on ChromeOS and in
// conjunction with the Verified Access Web API which both issues challenges
// and verifies responses. A successful verification by the Verified Access
// Web API is a strong signal of all of the following:
// * The current device is a legitimate Chrome OS device.
// * The current device is a legitimate ChromeOS device.
// * The current device is managed by the domain specified during
// verification.
// * The current signed-in user is managed by the domain specified during
tools/under-control/src/chrome/common/extensions/api/enterprise_platform_keys_internal.idl
+3 -3
View File
@@ -31,7 +31,7 @@ namespace enterprise.platformKeysInternal {
};
// Invoked by <code>getTokens</code>.
// |tokenIds| The list of IDs of the avialable Tokens.
// |tokenIds| The list of IDs of the available Tokens.
callback GetTokensCallback = void(DOMString[] tokenIds);
// Invoked by <code>generateKey</code>.
@@ -40,11 +40,11 @@ namespace enterprise.platformKeysInternal {
callback GenerateKeyCallback = void(ArrayBuffer publicKey);
interface Functions {
// Internal version of entrprise.platformKeys.getTokens. Returns a list of
// Internal version of enterprise.platformKeys.getTokens. Returns a list of
// token IDs instead of token objects.
static void getTokens(GetTokensCallback callback);
// Internal version of Token.generateKey, currently supporting only
// Internal version of SubtleCrypto.generateKey, currently supporting only
// RSASSA-PKCS1-v1_5 and ECDSA.
// |tokenId| The id of a Token returned by |getTokens|.
// |algorithm| The algorithm parameters as specified by WebCrypto.
tools/under-control/src/chrome/common/extensions/api/experimental_ai_data.idl
+1
View File
@@ -12,6 +12,7 @@ namespace experimentalAiData {
static void getAiData(long domNodeId,
DOMString frameId,
DOMString userInput,
long tabId,
DataCallback callback);
};
};
tools/under-control/src/chrome/common/extensions/api/passwords_private.idl
+10 -10
View File
@@ -353,7 +353,7 @@ namespace passwordsPrivate {
callback ExceptionListCallback = void(ExceptionEntry[] exceptions);
callback ExportProgressStatusCallback = void(ExportProgressStatus status);
callback VoidCallback = void();
callback OptInCallback = void(boolean optedIn);
callback IsAccountStorageEnabledCallback = void(boolean enabled);
callback PasswordCheckStatusCallback = void(PasswordCheckStatus status);
callback ImportPasswordsCallback = void(ImportResults results);
callback FetchFamilyResultsCallback = void(FamilyFetchResults results);
@@ -489,12 +489,12 @@ namespace passwordsPrivate {
static void requestExportProgressStatus(
ExportProgressStatusCallback callback);
// Requests the account-storage opt-in state of the current user.
static void isOptedInForAccountStorage(
OptInCallback callback);
// Requests the account-storage enabled state of the current user.
static void isAccountStorageEnabled(
IsAccountStorageEnabledCallback callback);
// Triggers the opt-in or opt-out flow for the account storage.
static void optInForAccountStorage(boolean optIn);
// Triggers the enabling / disabling flow for the account storage.
static void setAccountStorageEnabled(boolean enabled);
// Requests the latest insecure credentials.
static void getInsecureCredentials(
@@ -525,7 +525,7 @@ namespace passwordsPrivate {
// Requests whether the account store is a default location for saving
// passwords. False means the device store is a default one. Must be called
// when the current user has already opted-in for account storage.
// when account storage is enabled.
static void isAccountStoreDefault(
IsAccountStoreDefaultCallback callback);
@@ -603,9 +603,9 @@ namespace passwordsPrivate {
// |status|: The progress status and an optional UI message.
static void onPasswordsFileExportProgress(PasswordExportProgress status);
// Fired when the opt-in state for the account-scoped storage has changed.
// |optedIn|: The new opt-in state.
static void onAccountStorageOptInStateChanged(boolean optedIn);
// Fired when the enabled state for the account-scoped storage has changed.
// |enabled|: The new enabled state.
static void onAccountStorageEnabledStateChanged(boolean enabled);
// Fired when the insecure credentials changed.
// |insecureCredentials|: The updated insecure credentials.
tools/under-control/src/chrome/renderer/chrome_content_renderer_client.cc
+24 -5
View File
@@ -20,7 +20,6 @@
#include "base/no_destructor.h"
#include "base/notreached.h"
#include "base/process/current_process.h"
#include "base/profiler/process_type.h"
#include "base/strings/string_number_conversions.h"
#include "base/strings/string_util.h"
#include "base/strings/utf_string_conversions.h"
@@ -91,6 +90,9 @@
#include "components/error_page/common/error.h"
#include "components/error_page/common/localized_error.h"
#include "components/feed/feed_feature_list.h"
#include "components/fingerprinting_protection_filter/common/fingerprinting_protection_filter_features.h"
#include "components/fingerprinting_protection_filter/renderer/renderer_agent.h"
#include "components/fingerprinting_protection_filter/renderer/unverified_ruleset_dealer.h"
#include "components/grit/components_scaled_resources.h"
#include "components/heap_profiling/in_process/heap_profiler_controller.h"
#include "components/history_clusters/core/config.h"
@@ -110,6 +112,7 @@
#include "components/permissions/features.h"
#include "components/safe_browsing/buildflags.h"
#include "components/safe_browsing/content/renderer/threat_dom_details.h"
#include "components/sampling_profiler/process_type.h"
#include "components/sampling_profiler/thread_profiler.h"
#include "components/security_interstitials/content/renderer/security_interstitial_page_controller_delegate_impl.h"
#include "components/spellcheck/spellcheck_buildflags.h"
@@ -473,6 +476,13 @@ void ChromeContentRendererClient::RenderThreadStarted() {
subresource_filter_ruleset_dealer_ =
std::make_unique<subresource_filter::UnverifiedRulesetDealer>();
if (fingerprinting_protection_filter::features::
IsFingerprintingProtectionFeatureEnabled()) {
fingerprinting_protection_ruleset_dealer_ = std::make_unique<
fingerprinting_protection_filter::UnverifiedRulesetDealer>();
thread->AddObserver(fingerprinting_protection_ruleset_dealer_.get());
}
phishing_model_setter_ =
std::make_unique<safe_browsing::PhishingModelSetterImpl>();
@@ -748,6 +758,15 @@ void ChromeContentRendererClient::RenderFrameCreated(
subresource_filter_agent->Initialize();
}
if (fingerprinting_protection_filter::features::
IsFingerprintingProtectionFeatureEnabled() &&
fingerprinting_protection_ruleset_dealer_) {
auto* fingerprinting_protection_renderer_agent =
new fingerprinting_protection_filter::RendererAgent(
render_frame, fingerprinting_protection_ruleset_dealer_.get());
fingerprinting_protection_renderer_agent->Initialize();
}
#if !BUILDFLAG(IS_ANDROID)
base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
if (command_line->HasSwitch(switches::kInstantProcess) &&
@@ -810,7 +829,7 @@ void ChromeContentRendererClient::WebViewCreated(
const url::Origin* outermost_origin) {
new prerender::NoStatePrefetchClient(web_view);
#if BUILDFLAG(ENABLE_EXTENSIONS)
#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
extensions::ExtensionsRendererClient::Get()->WebViewCreated(web_view,
outermost_origin);
#endif
@@ -1411,7 +1430,7 @@ void ChromeContentRendererClient::PostIOThreadCreated(
io_thread_task_runner->PostTask(
FROM_HERE,
base::BindOnce(&sampling_profiler::ThreadProfiler::StartOnChildThread,
base::ProfilerThreadType::kIo));
sampling_profiler::ProfilerThreadType::kIo));
}
void ChromeContentRendererClient::PostCompositorThreadCreated(
@@ -1419,7 +1438,7 @@ void ChromeContentRendererClient::PostCompositorThreadCreated(
compositor_thread_task_runner->PostTask(
FROM_HERE,
base::BindOnce(&sampling_profiler::ThreadProfiler::StartOnChildThread,
base::ProfilerThreadType::kCompositor));
sampling_profiler::ProfilerThreadType::kCompositor));
// Enable stack sampling for tracing.
// We pass in CreateCoreUnwindersFactory here since it lives in the chrome/
// layer while TracingSamplerProfiler is outside of chrome/.
@@ -1747,7 +1766,7 @@ void ChromeContentRendererClient::
WillInitializeServiceWorkerContextOnWorkerThread() {
// This is called on the service worker thread.
sampling_profiler::ThreadProfiler::StartOnChildThread(
base::ProfilerThreadType::kServiceWorker);
sampling_profiler::ProfilerThreadType::kServiceWorker);
}
void ChromeContentRendererClient::
tools/under-control/src/components/policy/resources/templates/common_schemas.yaml
Executable
+382
View File
@@ -0,0 +1,382 @@
BookmarkType:
properties:
children:
items:
$ref: BookmarkType
type: array
name:
type: string
toplevel_name:
type: string
url:
type: string
type: object
CertPrincipalFields:
properties:
CN:
type: string
L:
type: string
O:
type: string
OU:
type: string
type: object
Config:
description: Configuration used to generate and verify Parent Access Code.
properties:
access_code_ttl:
description: Time that access code is valid for (in seconds).
maximum: 3600
minimum: 60
type: integer
clock_drift_tolerance:
description: The allowed difference between the clock on child and parent devices
(in seconds).
maximum: 1800
minimum: 0
type: integer
shared_secret:
description: Secret shared between child and parent devices.
type: string
type: object
DataControlsCondition:
properties:
and:
items:
$ref: DataControlsCondition
type: array
destinations:
properties:
incognito:
type: boolean
os_clipboard:
type: boolean
other_profile:
type: boolean
urls:
items:
type: string
type: array
type: object
not:
$ref: DataControlsCondition
or:
items:
$ref: DataControlsCondition
type: array
sources:
properties:
incognito:
type: boolean
os_clipboard:
type: boolean
other_profile:
type: boolean
urls:
items:
type: string
type: array
type: object
type: object
DayPercentagePair:
description: Contains the number of days and the percentage of the fleet that should
be updated after those days have passed.
properties:
days:
description: Days from update discovery.
maximum: 28
minimum: 1
type: integer
percentage:
description: Percentage of the fleet that should be updated after the given
days.
maximum: 100
minimum: 0
type: integer
type: object
DeviceLoginScreenPowerSettings:
description: Power management settings applicable only when running on AC power
properties:
Delays:
properties:
Idle:
description: The length of time without user input after which the idle
action is taken, in milliseconds
minimum: 0
type: integer
ScreenDim:
description: The length of time without user input after which the screen
is dimmed, in milliseconds
minimum: 0
type: integer
ScreenOff:
description: The length of time without user input after which the screen
is turned off, in milliseconds
minimum: 0
type: integer
type: object
IdleAction:
description: Action to take when the idle delay is reached
enum:
- Suspend
- Shutdown
- DoNothing
type: string
type: object
DisallowedTimeInterval:
description: Start time of the interval, inclusive.
properties:
day_of_week:
description: Day of the week for the interval.
enum:
- Monday
- Tuesday
- Wednesday
- Thursday
- Friday
- Saturday
- Sunday
type: string
hours:
description: Hours elapsed since the start of the day in (24 hour format).
maximum: 23
minimum: 0
type: integer
minutes:
description: Minutes elapsed in the current hour.
maximum: 59
minimum: 0
type: integer
required:
- day_of_week
- minutes
- hours
type: object
DomainFiletypePair:
properties:
domains:
items:
type: string
type: array
file_extension:
type: string
type: object
ExtensionAllowedTypes:
items:
enum:
- extension
- theme
- user_script
- hosted_app
- legacy_packaged_app
- platform_app
type: string
type: array
ExtensionInstallSources:
items:
type: string
type: array
ListOfPermissions:
items:
pattern: ^[a-z][a-zA-Z0-9.]*$
type: string
type: array
ListOfUrlPatterns:
items:
type: string
type: array
PowerManagementDelays:
description: Delays and actions to take when the device is idle and running on AC
power
properties:
Delays:
properties:
Idle:
description: The length of time without user input after which the idle
action is taken, in milliseconds
minimum: 0
type: integer
IdleWarning:
description: The length of time without user input after which a warning
dialog is shown, in milliseconds
minimum: 0
type: integer
ScreenDim:
description: The length of time without user input after which the screen
is dimmed, in milliseconds
minimum: 0
type: integer
ScreenOff:
description: The length of time without user input after which the screen
is turned off, in milliseconds
minimum: 0
type: integer
type: object
IdleAction:
description: Action to take when the idle delay is reached
enum:
- Suspend
- Logout
- Shutdown
- DoNothing
type: string
type: object
ProxyServerMode:
enum:
- 0
- 1
- 2
- 3
type: integer
QuickUnlockModeAllowlist:
items:
enum:
- all
- PIN
- FINGERPRINT
type: string
type: array
QuickUnlockModeWhitelist:
items:
enum:
- all
- PIN
- FINGERPRINT
type: string
type: array
Time:
description: Time interpreted in local wall-clock 24h format.
properties:
hour:
maximum: 23
minimum: 0
type: integer
minute:
maximum: 59
minimum: 0
type: integer
required:
- hour
- minute
type: object
TimeUsageLimitEntry:
properties:
last_updated_millis:
type: string
usage_quota_mins:
minimum: 0
type: integer
type: object
UsbDeviceId:
properties:
product_id:
type: integer
vendor_id:
type: integer
type: object
UsbDeviceIdInclusive:
properties:
product_id:
type: integer
vendor_id:
type: integer
type: object
WebAuthnFactors:
items:
enum:
- all
- PIN
- FINGERPRINT
type: string
type: array
WeekDay:
enum:
- MONDAY
- TUESDAY
- WEDNESDAY
- THURSDAY
- FRIDAY
- SATURDAY
- SUNDAY
type: string
WeeklyTime:
description: Use WeeklyTimeChecked in new code.
properties:
day_of_week:
$ref: WeekDay
time:
description: Milliseconds since midnight.
type: integer
type: object
WeeklyTimeIntervals:
description: Use WeeklyTimeIntervalChecked in new code.
properties:
end:
$ref: WeeklyTime
start:
$ref: WeeklyTime
type: object
WeeklyTimeChecked:
properties:
day_of_week:
$ref: WeekDay
milliseconds_since_midnight:
minimum: 0
maximum: 86399999
type: integer
required:
- day_of_week
- milliseconds_since_midnight
type: object
WeeklyTimeIntervalChecked:
properties:
start:
$ref: WeeklyTimeChecked
end:
$ref: WeeklyTimeChecked
required:
- start
- end
type: object
file_transfer_enable_disable_schema:
items:
properties:
source_destination_list:
items:
properties:
destinations:
$ref: file_transfer_source_destination_schema
sources:
$ref: file_transfer_source_destination_schema
type: object
type: array
tags:
items:
type: string
type: array
type: object
type: array
file_transfer_source_destination_schema:
items:
properties:
file_system_type:
enum:
- UNKNOWN
- ANY
- '*'
- MY_FILES
- REMOVABLE
- DEVICE_MEDIA_STORAGE
- PROVIDED
- ARC
- GOOGLE_DRIVE
- SMB
- CROSTINI
- PLUGIN_VM
- BOREALIS
- BRUSCHETTA
- UNKNOWN_VM
type: string
type: object
type: array
tools/under-control/src/components/policy/resources/templates/legacy_device_policy_proto_map.yaml
Executable
+58
View File
@@ -0,0 +1,58 @@
# Legacy device policies that don't have a 1:1 mapping between template and
# chrome_device_policy.proto or where the types don't map the same way as for
# user policy, so that code is not (easily) generatable. Do not add new device
# policies here, make sure the proto is set up the same way as the (generated)
# user policy proto.
# Add deprecated policies here, though, if the proto field got deleted.
# Add removed policies mapping here.
? ''
:
# Proto fields with unknown policy.
- device_reporting.report_running_kiosk_app
- camera_enabled.camera_enabled
# Not an actual policy.
- auto_update_settings.target_version_display_name
# Deprecated device policies where the proto field got deleted.
DeviceAppPack:
- ''
DeviceIdleLogoutTimeout:
- ''
DeviceIdleLogoutWarningDuration:
- ''
DeviceLoginScreenSaverId:
- ''
DeviceLoginScreenSaverTimeout:
- ''
DeviceStartUpFlags:
- ''
DeviceStartUpUrls:
- ''
# DeviceOffHours is one-to-many and uses a strongly typed proto.
DeviceOffHours:
- device_off_hours.intervals
- device_off_hours.timezone
- device_off_hours.ignored_policy_proto_tags
# DeviceUpdateAllowedConnectionTypes is not generatable since the proto uses
# enums, whereas the schema uses strings.
DeviceUpdateAllowedConnectionTypes:
- auto_update_settings.allowed_connection_types
# NetworkThrottlingEnabled is one-to-many and uses a strongly typed proto.
NetworkThrottlingEnabled:
- network_throttling.enabled
- network_throttling.upload_rate_kbits
- network_throttling.download_rate_kbits
# TPMFirmwareUpdateSettings is one-to-many and uses a strongly typed proto.
TPMFirmwareUpdateSettings:
- tpm_firmware_update_settings.auto_update_mode
- tpm_firmware_update_settings.allow_user_initiated_powerwash
- tpm_firmware_update_settings.allow_user_initiated_preserve_device_state
# UsbDetachableAllowlist is a strongly typed proto.
UsbDetachableAllowlist:
- usb_detachable_allowlist.id
# UsbDetachableWhitelist is a strongly typed proto.
UsbDetachableWhitelist:
- usb_detachable_whitelist.id
tools/under-control/src/components/policy/resources/templates/manual_device_policy_proto_map.yaml
Executable
+228
View File
@@ -0,0 +1,228 @@
# Mapping between device policies and fields in chrome_device_policy.proto.
AllowKioskAppControlChromeVersion: allow_kiosk_app_control_chrome_version.allow_kiosk_app_control_chrome_version
AttestationEnabledForDevice: attestation_settings.attestation_enabled
AttestationForContentProtectionEnabled: attestation_settings.content_protection_enabled
AutoCleanUpStrategy: auto_clean_up_settings.clean_up_strategy
CastReceiverName: cast_receiver_name.name
ChromadToCloudMigrationEnabled: chromad_to_cloud_migration_enabled.value
ChromeOsReleaseChannel: release_channel.release_channel
ChromeOsReleaseChannelDelegated: release_channel.release_channel_delegated
DeviceAdvancedBatteryChargeModeDayConfig: device_advanced_battery_charge_mode.day_configs
DeviceAdvancedBatteryChargeModeEnabled: device_advanced_battery_charge_mode.enabled
DeviceAllowBluetooth: allow_bluetooth.allow_bluetooth
DeviceAllowMGSToStoreDisplayProperties: device_allow_mgs_to_store_display_properties.value
DeviceAllowNewUsers: allow_new_users.allow_new_users
DeviceAllowRedeemChromeOsRegistrationOffers: allow_redeem_offers.allow_redeem_offers
DeviceAllowedBluetoothServices: device_allowed_bluetooth_services.allowlist
DeviceArcDataSnapshotHours: arc_data_snapshot_hours.arc_data_snapshot_hours
DeviceAuthDataCacheLifetime: device_auth_data_cache_lifetime.lifetime_hours
DeviceAuthenticationURLAllowlist: device_authentication_url_allowlist.value
DeviceAuthenticationURLBlocklist: device_authentication_url_blocklist.value
DeviceAutoUpdateDisabled: auto_update_settings.update_disabled
DeviceAutoUpdateP2PEnabled: auto_update_settings.p2p_enabled
DeviceAutoUpdateTimeRestrictions: auto_update_settings.disallowed_time_intervals
DeviceAutofillSAMLUsername: saml_username.url_parameter_to_autofill_saml_username
DeviceBatteryChargeCustomStartCharging: device_battery_charge_mode.custom_charge_start
DeviceBatteryChargeCustomStopCharging: device_battery_charge_mode.custom_charge_stop
DeviceBatteryChargeMode: device_battery_charge_mode.battery_charge_mode
DeviceBlockDevmode: system_settings.block_devmode
DeviceBootOnAcEnabled: device_boot_on_ac.enabled
DeviceBorealisAllowed: device_borealis_allowed.allowed
DeviceChannelDowngradeBehavior: auto_update_settings.channel_downgrade_behavior
DeviceChromeVariations: device_chrome_variations_type.value
DeviceCrostiniArcAdbSideloadingAllowed: device_crostini_arc_adb_sideloading_allowed.mode
DeviceDataRoamingEnabled: data_roaming_enabled.data_roaming_enabled
DeviceDebugPacketCaptureAllowed: device_debug_packet_capture_allowed.allowed
DeviceDisplayResolution: device_display_resolution.device_display_resolution
DeviceDockMacAddressSource: device_dock_mac_address_source.source
DeviceEcryptfsMigrationStrategy: device_ecryptfs_migration_strategy.migration_strategy
DeviceEncryptedReportingPipelineEnabled: device_reporting.encrypted_reporting_pipeline_enabled
DeviceEphemeralUsersEnabled: ephemeral_users_enabled.ephemeral_users_enabled
DeviceEphemeralNetworkPoliciesEnabled: device_ephemeral_network_policies_enabled.value
DeviceExtendedFkeysModifier: extended_fkeys_modifier.modifier
DeviceExternalPrintServers: external_print_servers.external_policy
DeviceExternalPrintServersAllowlist: external_print_servers_allowlist.allowlist
DeviceFamilyLinkAccountsAllowed: family_link_accounts_allowed.family_link_accounts_allowed
DeviceFlexHwDataForProductImprovementEnabled: device_flex_hw_data_for_product_improvement_enabled.enabled
DeviceLoginScreenGeolocationAccessLevel: device_login_screen_geolocation_access_level.geolocation_access_level
DeviceGpoCacheLifetime: device_gpo_cache_lifetime.lifetime_hours
DeviceGuestModeEnabled: guest_mode_enabled.guest_mode_enabled
DeviceHostnameTemplate: network_hostname.device_hostname_template
DeviceHostnameUserConfigurable: hostname_user_configurable.device_hostname_user_configurable
DeviceI18nShortcutsEnabled: device_i18n_shortcuts_enabled.enabled
DeviceKerberosEncryptionTypes: device_kerberos_encryption_types.types
DeviceKeyboardBacklightColor: keyboard_backlight_color.color
DeviceKeylockerForStorageEncryptionEnabled: keylocker_for_storage_encryption_enabled.enabled
DeviceLocalAccountAutoLoginBailoutEnabled: device_local_accounts.enable_auto_login_bailout
DeviceLocalAccountAutoLoginDelay: device_local_accounts.auto_login_delay
DeviceLocalAccountAutoLoginId: device_local_accounts.auto_login_id
DeviceLocalAccountPromptForNetworkWhenOffline: device_local_accounts.prompt_for_network_when_offline
DeviceLocalAccounts: device_local_accounts.account
DeviceLoginScreenAccessibilityShortcutsEnabled: accessibility_settings.login_screen_shortcuts_enabled
DeviceLoginScreenAutoSelectCertificateForUrls: device_login_screen_auto_select_certificate_for_urls.login_screen_auto_select_certificate_rules
DeviceLoginScreenAutoclickEnabled: accessibility_settings.login_screen_autoclick_enabled
DeviceLoginScreenCaretHighlightEnabled: accessibility_settings.login_screen_caret_highlight_enabled
DeviceLoginScreenContextAwareAccessSignalsAllowlist: device_login_screen_context_aware_access_signals_allowlist.value
DeviceLoginScreenCursorHighlightEnabled: accessibility_settings.login_screen_cursor_highlight_enabled
DeviceLoginScreenDefaultHighContrastEnabled: accessibility_settings.login_screen_default_high_contrast_enabled
DeviceLoginScreenDefaultLargeCursorEnabled: accessibility_settings.login_screen_default_large_cursor_enabled
DeviceLoginScreenDefaultScreenMagnifierType: accessibility_settings.login_screen_default_screen_magnifier_type
DeviceLoginScreenDefaultSpokenFeedbackEnabled: accessibility_settings.login_screen_default_spoken_feedback_enabled
DeviceLoginScreenDefaultVirtualKeyboardEnabled: accessibility_settings.login_screen_default_virtual_keyboard_enabled
DeviceLoginScreenDictationEnabled: accessibility_settings.login_screen_dictation_enabled
DeviceLoginScreenDomainAutoComplete: login_screen_domain_auto_complete.login_screen_domain_auto_complete
DeviceLoginScreenExtensions: device_login_screen_extensions.device_login_screen_extensions
DeviceLoginScreenExtensionManifestV2Availability: login_screen_extension_manifest_v2_availability.login_screen_extension_manifest_v2_availability
DeviceLoginScreenHighContrastEnabled: accessibility_settings.login_screen_high_contrast_enabled
DeviceLoginScreenInputMethods: login_screen_input_methods.login_screen_input_methods
DeviceLoginScreenIsolateOrigins: device_login_screen_isolate_origins.isolate_origins
DeviceLoginScreenKeyboardFocusHighlightEnabled: accessibility_settings.login_screen_keyboard_focus_highlight_enabled
DeviceLoginScreenLargeCursorEnabled: accessibility_settings.login_screen_large_cursor_enabled
DeviceLoginScreenLocales: login_screen_locales.login_screen_locales
DeviceLoginScreenMonoAudioEnabled: accessibility_settings.login_screen_mono_audio_enabled
DeviceLoginScreenPowerManagement: login_screen_power_management.login_screen_power_management
DeviceLoginScreenPrimaryMouseButtonSwitch: login_screen_primary_mouse_button_switch.value
DeviceLoginScreenPrivacyScreenEnabled: device_login_screen_privacy_screen_enabled.enabled
DeviceLoginScreenPromptOnMultipleMatchingCertificates: login_screen_prompt_on_multiple_matching_certificates.value
DeviceLoginScreenScreenMagnifierType: accessibility_settings.login_screen_screen_magnifier_type
DeviceLoginScreenSelectToSpeakEnabled: accessibility_settings.login_screen_select_to_speak_enabled
DeviceLoginScreenShowOptionsInSystemTrayMenu: accessibility_settings.login_screen_show_options_in_system_tray_menu_enabled
DeviceLoginScreenSitePerProcess: device_login_screen_site_per_process.site_per_process
DeviceLoginScreenSpokenFeedbackEnabled: accessibility_settings.login_screen_spoken_feedback_enabled
DeviceLoginScreenStickyKeysEnabled: accessibility_settings.login_screen_sticky_keys_enabled
DeviceLoginScreenSystemInfoEnforced: device_login_screen_system_info_enforced.value
DeviceLoginScreenTouchVirtualKeyboardEnabled: DeviceLoginScreenTouchVirtualKeyboardEnabled.value
DeviceLoginScreenVirtualKeyboardEnabled: accessibility_settings.login_screen_virtual_keyboard_enabled
DeviceLoginScreenWebUILazyLoading: login_web_ui_lazy_loading.enabled
DeviceLoginScreenWebHidAllowDevicesForUrls: device_login_screen_webhid_allow_devices_for_urls.value
DeviceLoginScreenWebUsbAllowDevicesForUrls: device_login_screen_webusb_allow_devices_for_urls.device_login_screen_webusb_allow_devices_for_urls
DeviceMachinePasswordChangeRate: device_machine_password_change_rate.rate_days
DeviceMetricsReportingEnabled: metrics_enabled.metrics_enabled
DeviceMinimumVersion: device_minimum_version.value
DeviceMinimumVersionAueMessage: device_minimum_version_aue_message.value
DeviceNativePrinters: native_device_printers.external_policy
DeviceNativePrintersAccessMode: native_device_printers_access_mode.access_mode
DeviceNativePrintersBlacklist: native_device_printers_blacklist.blacklist # nocheck
DeviceNativePrintersWhitelist: native_device_printers_whitelist.whitelist # nocheck
DeviceOpenNetworkConfiguration: open_network_configuration.open_network_configuration
DevicePciPeripheralDataAccessEnabled: device_pci_peripheral_data_access_enabled_v2.enabled
DevicePolicyRefreshRate: device_policy_refresh_rate.device_policy_refresh_rate
DevicePowerPeakShiftBatteryThreshold: device_power_peak_shift.battery_threshold
DevicePowerPeakShiftDayConfig: device_power_peak_shift.day_configs
DevicePowerPeakShiftEnabled: device_power_peak_shift.enabled
DevicePowerwashAllowed: device_powerwash_allowed.device_powerwash_allowed
DevicePrinters: device_printers.external_policy
DevicePrintersAccessMode: device_printers_access_mode.access_mode
DevicePrintersAllowlist: device_printers_allowlist.allowlist
DevicePrintersBlocklist: device_printers_blocklist.blocklist
DevicePrintingClientNameTemplate: device_printing_client_name_template.value
DeviceQuickFixBuildToken: auto_update_settings.device_quick_fix_build_token
DeviceQuirksDownloadEnabled: quirks_download_enabled.quirks_download_enabled
DeviceRebootOnShutdown: reboot_on_shutdown.reboot_on_shutdown
DeviceRebootOnUserSignout: device_reboot_on_user_signout.reboot_on_signout_mode
DeviceReleaseLtsTag: release_channel.release_lts_tag
DeviceReportXDREvents: device_report_xdr_events.enabled
DeviceRestrictedManagedGuestSessionEnabled: device_restricted_managed_guest_session_enabled.enabled
DeviceRollbackAllowedMilestones: auto_update_settings.rollback_allowed_milestones
DeviceRollbackToTargetVersion: auto_update_settings.rollback_to_target_version
DeviceRunAutomaticCleanupOnLogin: device_run_automatic_cleanup_on_login.value
DeviceScheduledReboot: device_scheduled_reboot.device_scheduled_reboot_settings
DeviceScheduledUpdateCheck: device_scheduled_update_check.device_scheduled_update_check_settings
DeviceSecondFactorAuthentication: device_second_factor_authentication.mode
DeviceShowLowDiskSpaceNotification: device_show_low_disk_space_notification.device_show_low_disk_space_notification
DeviceShowNumericKeyboardForPassword: device_show_numeric_keyboard_for_password.value
DeviceShowUserNamesOnSignin: show_user_names.show_user_names
DeviceSwitchFunctionKeysBehaviorEnabled: device_switch_function_keys_behavior_enabled.enabled
DeviceSystemWideTracingEnabled: device_system_wide_tracing_enabled.enabled
DeviceTargetVersionPrefix: auto_update_settings.target_version_prefix
DeviceTargetVersionSelector: auto_update_settings.target_version_selector
DeviceTransferSAMLCookies: saml_settings.transfer_saml_cookies
DeviceUnaffiliatedCrostiniAllowed: device_unaffiliated_crostini_allowed.device_unaffiliated_crostini_allowed
DeviceUpdateHttpDownloadsEnabled: auto_update_settings.http_downloads_enabled
DeviceUpdateScatterFactor: auto_update_settings.scatter_factor_in_seconds
DeviceUpdateStagingSchedule: auto_update_settings.staging_schedule
DeviceUsbPowerShareEnabled: device_usb_power_share.enabled
DeviceUserAllowlist: user_allowlist.user_allowlist
DeviceUserPolicyLoopbackProcessingMode: device_user_policy_loopback_processing_mode.mode
DeviceUserWhitelist: user_whitelist.user_whitelist
DeviceVariationsRestrictParameter: variations_parameter.parameter
DeviceWallpaperImage: device_wallpaper_image.device_wallpaper_image
DeviceWebBasedAttestationAllowedUrls: device_web_based_attestation_allowed_urls.value
DeviceWiFiAllowed: device_wifi_allowed.device_wifi_allowed
DeviceWiFiFastTransitionEnabled: device_wifi_fast_transition_enabled.device_wifi_fast_transition_enabled
DeviceWilcoDtcAllowed: device_wilco_dtc_allowed.device_wilco_dtc_allowed
DeviceWilcoDtcConfiguration: device_wilco_dtc_configuration.device_wilco_dtc_configuration
DisplayRotationDefault: display_rotation_default.display_rotation_default
EnableDeviceGranularReporting: device_reporting.enable_granular_reporting
ExtensionCacheSize: extension_cache_size.extension_cache_size
HeartbeatEnabled: device_heartbeat_settings.heartbeat_enabled
HeartbeatFrequency: device_heartbeat_settings.heartbeat_frequency
DeviceHindiInscriptLayoutEnabled: device_hindi_inscript_layout_enabled.enabled
KioskCRXManifestUpdateURLIgnored: kiosk_crx_manifest_update_url_ignored.value
LogUploadEnabled: device_log_upload_settings.system_log_upload_enabled
LoginAuthenticationBehavior: login_authentication_behavior.login_authentication_behavior
LoginVideoCaptureAllowedUrls: login_video_capture_allowed_urls.urls
ManagedGuestSessionPrivacyWarningsEnabled: managed_guest_session_privacy_warnings.enabled
MinimumRequiredChromeVersion: minimum_required_version.chrome_version
PluginVmAllowed: plugin_vm_allowed.plugin_vm_allowed
PluginVmLicenseKey: plugin_vm_license_key.plugin_vm_license_key
RebootAfterUpdate: auto_update_settings.reboot_after_update
ReportCRDSessions: device_reporting.report_crd_sessions
ReportDeviceActivityTimes: device_reporting.report_activity_times
ReportDeviceAppInfo: device_reporting.report_app_info
ReportDeviceAudioStatus: device_reporting.report_audio_status
ReportDeviceAudioStatusCheckingRateMs: device_reporting.report_device_audio_status_checking_rate_ms
ReportDeviceBacklightInfo: device_reporting.report_backlight_info
ReportDeviceBluetoothInfo: device_reporting.report_bluetooth_info
ReportDeviceBoardStatus: device_reporting.report_board_status
ReportDeviceBootMode: device_reporting.report_boot_mode
ReportDeviceCpuInfo: device_reporting.report_cpu_info
ReportDeviceCrashReportInfo: device_reporting.report_crash_report_info
ReportDeviceFanInfo: device_reporting.report_fan_info
ReportDeviceGraphicsStatus: device_reporting.report_graphics_status
ReportDeviceHardwareStatus: device_reporting.report_hardware_status
ReportDeviceLocation: device_reporting.report_location
ReportDeviceLoginLogout: device_reporting.report_login_logout
ReportDeviceMemoryInfo: device_reporting.report_memory_info
ReportDeviceNetworkConfiguration: device_reporting.report_network_configuration
ReportDeviceNetworkInterfaces: device_reporting.report_network_interfaces
ReportDeviceNetworkStatus: device_reporting.report_network_status
ReportDeviceNetworkTelemetryCollectionRateMs: device_reporting.report_network_telemetry_collection_rate_ms
ReportDeviceNetworkTelemetryEventCheckingRateMs: device_reporting.report_network_telemetry_event_checking_rate_ms
ReportDeviceOsUpdateStatus: device_reporting.report_os_update_status
ReportDevicePeripherals: device_reporting.report_peripherals
ReportDevicePowerStatus: device_reporting.report_power_status
ReportDevicePrintJobs: device_reporting.report_print_jobs
DeviceReportRuntimeCounters: device_reporting.report_runtime_counters
DeviceReportRuntimeCountersCheckingRateMs: device_reporting.device_report_runtime_counters_checking_rate_ms
ReportDeviceSecurityStatus: device_reporting.report_security_status
ReportDeviceSessionStatus: device_reporting.report_session_status
ReportDeviceSignalStrengthEventDrivenTelemetry: device_reporting.report_signal_strength_event_driven_telemetry.entries
ReportDeviceStorageStatus: device_reporting.report_storage_status
ReportDeviceSystemInfo: device_reporting.report_system_info
ReportDeviceTimezoneInfo: device_reporting.report_timezone_info
ReportDeviceUsers: device_reporting.report_users
ReportDeviceVersionInfo: device_reporting.report_version_info
ReportDeviceVpdInfo: device_reporting.report_vpd_info
ReportUploadFrequency: device_reporting.device_status_frequency
RequiredClientCertificateForDevice: required_client_certificate_for_device.required_client_certificate_for_device
SupervisedUsersEnabled: supervised_users_settings.supervised_users_enabled
DeviceSystemAecEnabled: device_system_aec_enabled.device_system_aec_enabled
SystemProxySettings: system_proxy_settings.system_proxy_settings
SystemTimezone: system_timezone.timezone
SystemTimezoneAutomaticDetection: system_timezone.timezone_detection_type
SystemUse24HourClock: use_24hour_clock.use_24hour_clock
UnaffiliatedArcAllowed: unaffiliated_arc_allowed.unaffiliated_arc_allowed
UptimeLimit: uptime_limit.uptime_limit
VirtualMachinesAllowed: virtual_machines_allowed.virtual_machines_allowed
DeviceScreensaverLoginScreenEnabled: device_screensaver_login_screen_enabled.device_screensaver_login_screen_enabled
DeviceScreensaverLoginScreenIdleTimeoutSeconds: device_screensaver_login_screen_idle_timeout_seconds.device_screensaver_login_screen_idle_timeout_seconds
DeviceScreensaverLoginScreenImageDisplayIntervalSeconds: device_screensaver_login_screen_image_display_interval_seconds.device_screensaver_login_screen_image_display_interval_seconds
DeviceScreensaverLoginScreenImages: device_screensaver_login_screen_images.device_screensaver_login_screen_images
DeviceActivityHeartbeatEnabled: device_reporting.device_activity_heartbeat_enabled
DeviceActivityHeartbeatCollectionRateMs: device_reporting.device_activity_heartbeat_collection_rate_ms
DeviceReportNetworkEvents: device_reporting.report_network_events
DeviceLowBatterySoundEnabled: device_low_battery_sound.enabled
DeviceChargingSoundsEnabled: device_charging_sounds.enabled
DeviceDlcPredownloadList: device_dlc_predownload_list.value
# Mappings for new device policies are generated by default.
tools/under-control/src/components/policy/resources/templates/messages.yaml
Executable
+241
View File
@@ -0,0 +1,241 @@
deprecated_policy_desc:
desc: Description shared by all deprecated policies, in Microsoft Windows' Group
Policy Editor.
text: This policy is deprecated. Its usage is discouraged. Read more at https://support.google.com/chrome/a/answer/7643500
deprecated_policy_group_caption:
desc: Localized name for the deprecated policies folder, for Microsoft's Group Policy
Editor.
text: Deprecated policies
deprecated_policy_group_desc:
desc: Localized description for the deprecated policies folder, for Microsoft's
Group Policy Editor.
text: These policies are included here to make them easy to remove.
doc_android_restriction_name:
desc: Caption text of the field 'android restriction name' in the summary chart
of a policy in the generated documentation
text: 'Android restriction name:'
doc_android_webview_restriction_name:
desc: Caption text of the field 'android webview restriction name' in the summary
chart of a policy in the generated documentation
text: 'Android WebView restriction name:'
doc_arc_support:
desc: Caption text of the field in the generated documentation that describes how
a policy affects Android applications on ChromeOS
text: 'Note for <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices
supporting Android apps:'
doc_back_to_top:
desc: Text of a link in the generated policy documentation, that takes the user
to the top of the page
text: Back to top
doc_banner:
desc: A banner shown at the top of the policy documentation
text: The Chrome Enterprise policy list is moving! Please update your bookmarks
to <ph name="POLICY_DOCUMENTATION_URL">https://cloud.google.com/docs/chrome-enterprise/policies/<ex>https://cloud.google.com/docs/chrome-enterprise/policies/</ex></ph>.
doc_chrome_os_example_value:
desc: Caption text of the field 'windows (ChromeOS clients)' in the summary chart
of a policy in the generated documentation
text: 'Windows (<ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> clients):'
doc_chrome_os_reg_loc:
desc: Caption text of the field '<ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>
registry location' in the summary chart of a policy in the generated documentation
text: 'Windows registry location for <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>
clients:'
doc_complex_policies_on_windows:
desc: Text pointing the user to a help article for complex policies on Windows
text: encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>
doc_data_type:
desc: Caption text of the field 'data type' in the summary chart of a policy in
the generated documentation
text: 'Data type:'
doc_deprecated:
desc: Text appended in parentheses to the policy name to indicate that it has been
deprecated
text: Deprecated
doc_description:
desc: Caption text of the 'description text' in the summary chart of a policy in
the generated documentation
text: 'Description:'
doc_description_column_title:
desc: Appears at the top of the policy summary table, over the column of short policy
descriptions, in the generated policy documentation
text: Description
doc_example_value:
desc: Caption text of the field 'example value' in the summary chart of a policy
in the generated documentation
text: 'Example value:'
doc_feature_can_be_mandatory:
desc: The name of the feature that indicates for a given policy that it can be mandatory,
instead of recommended
text: Can Be Mandatory
doc_feature_can_be_recommended:
desc: The name of the feature that indicates for a given policy that it can be recommended,
instead of mandatory
text: Can Be Recommended
doc_feature_cloud_only:
desc: The name of the fature that indicates whether a policy can only be set from
Admin Console.
text: Cloud Only
doc_feature_dynamic_refresh:
desc: The name of the feature that indicates for a given policy that changes to
it are respected by Chromium without a browser restart
text: Dynamic Policy Refresh
doc_feature_internal_only:
desc: The name of the feature that indicates whether a policy is used for internal
development or testing purposes.
text: Internal Only
doc_feature_metapolicy_type:
desc: The name of the feature that indicates the type of metapolicy a policy is,
if any.
text: Metapolicy Type
doc_feature_per_profile:
desc: The name of the feature that indicates whether a policy is applicable to browser
Profiles individually or whether it affects the entire browser.
text: Per Profile
doc_feature_platform_only:
desc: The name of the feature that indicates whether a policy can only be set with
platfrom policy.
text: Platform Only
doc_feature_unlisted:
desc: The name of the feature that indicates whether a policy is set from cloud
without any user interface.
text: Unlisted
doc_feature_user_only:
desc: The name of the feature that indicates whether a policy can only be set with
signed in managed account.
text: User Only
doc_group_intro:
desc: Introduction text for the generated policy atomic group documentation
text: Both Chromium and Google Chrome have some groups of policies that depend on
each other to provide control over a feature. These sets are represented by the
following policy groups. Given that policies can have multiple sources, only values
coming from the highest priority source will be applied. Values coming from a
lower priority source in the same group will be ignored. The order of priority
is defined in <ph name="POLICY_PRIORITY_DOC_URL">https://support.google.com/chrome/a/?p=policy_order<ex>https://support.google.com/chrome/a/?p=policy_order</ex></ph>.
doc_intro:
desc: Introduction text for the generated policy documentation
text: |-
Both Chromium and Google Chrome support the same set of policies. Please note that this document may include unreleased policies (i.e. their 'Supported on' entry refers to a not-yet released version of <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>) which are subject to change or removal without notice and for which no guarantees of any kind are provided, including no guarantees with respect to their security and privacy properties.
These policies are strictly intended to be used to configure instances of <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> internal to your organization. Use of these policies outside of your organization (for example, in a publicly distributed program) is considered malware and will likely be labeled as malware by Google and anti-virus vendors.
These settings don't need to be configured manually! Easy-to-use templates for Windows, Mac and Linux are available for download from <ph name="POLICY_TEMPLATE_DOWNLOAD_URL">https://www.chromium.org/administrators/policy-templates<ex> https://www.chromium.org/administrators/policy-templates</ex></ph>.
The recommended way to configure policy on Windows is via GPO, although provisioning policy via registry is still supported for Windows instances that are joined to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.
doc_legacy_single_line_label:
desc: A label for the legacy single-line textbox for a policy also has a more user-friendly
multi-line textbox. See http://crbug/829328
text: <ph name="POLICY_NAME">$6<ex>Wallpaper Image</ex></ph> (The single-line field
is deprecated and will be removed in the future. Please start using the multi-line
textbox below.)
doc_mac_linux_pref_name:
desc: Caption text of the field 'mac/linux preference name' in the summary chart
of a policy in the generated documentation
text: 'Mac/Linux preference name:'
doc_name_column_title:
desc: Appears at the top of the policy summary table, over the column of policy
names, in the generated policy documentation
text: Policy Name
doc_not_supported:
desc: Appears next to the name of each unsupported feature in the 'list of supported
policy features' in the generated policy documentation
text: 'No'
doc_oma_uri:
desc: Caption text of the field 'oma-uri' in the summary chart of a policy in the
generated documentation
text: '<ph name="OMA_URI">OMA-URI</ph>:'
doc_policy_atomic_group:
desc: Caption text of the 'policy atomic group' in the summary chart of a policy
in the generated documentation
text: 'Policy atomic group:'
doc_policy_documentation:
desc: Link title for the policy documentation
text: Documentation for policy
doc_policy_in_atomic_group:
desc: Label notifying that a policy is part of an atomic policy group
text: 'This policy is part of the following atomic group (only policies from the
highest priority source present in the group are applied) :'
doc_policy_restriction:
desc: Caption text of the field 'restrictions' in the summary chart of a policy
in the generated documentation
text: 'Restrictions:'
doc_range_maximum:
desc: Caption text of the field 'maximum' in the summary chart of a policy in the
generated documentation. Present only if policy has a maximum range restriction.
text: 'Maximum:'
doc_range_minimum:
desc: Caption text of the field 'minimum' in the summary chart of a policy in the
generated documentation. Present only if policy has a minimum range restriction.
text: 'Minimum:'
doc_recommended:
desc: Text appended in parentheses next to the policies top-level container to indicate
that those policies are of the Recommended level
text: Default Settings (users can override)
doc_reference_link:
desc: Text pointing the user to the reference page for this policy, which may have
more info (since it doesn't have a size limit)
text: 'Reference: <ph name="REFERENCE_URL">$6<ex>https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WallpaperImage</ex></ph>'
doc_schema:
desc: Caption text of the 'schema' in the summary chart of a policy in the generated
documentation
text: 'Schema:'
doc_schema_description_link:
desc: Text pointing the user to the expanded documentation page for this policy,
containing the information about schema and formatting.
text: See <ph name="REFERENCE_URL">$6<ex>https://cloud.google.com/docs/chrome-enterprise/policies/?policy=WallpaperImage</ex></ph>
for more information about schema and formatting.
doc_since_version:
desc: Text in the summary chart of a policy that specifies the version number in
which the policy was introduced.
text: since version <ph name="SINCE_VERSION">$6<ex>8</ex></ph>
doc_supported:
desc: Appears next to the name of each supported feature in the 'list of supported
policy features' in the generated policy documentation
text: 'Yes'
doc_supported_features:
desc: Caption text of the list of 'policy features that this policy supports' in
the summary chart of a policy in the generated documentation
text: 'Supported features:'
doc_supported_on:
desc: Caption text of the list of 'products, platforms and versions where this policy
is supported' in the summary chart of a policy in the generated documentation
text: 'Supported on:'
doc_until_version:
desc: Text in the summary chart of a policy that specifies the version number after
which the policy was dropped.
text: until version <ph name="UNTIL_VERSION">$6<ex>10</ex></ph>
doc_url_schema:
desc: Caption text of the field with the link to expanded schema description in
the summary chart of a policy in the generated documentation
text: 'Expanded schema description:'
doc_win_example_value:
desc: Caption text of the field 'windows (windows clients)' in the summary chart
of a policy in the generated documentation
text: 'Windows (Windows clients):'
doc_win_reg_loc:
desc: Caption text of the field 'windows registry location' in the summary chart
of a policy in the generated documentation
text: 'Windows registry location for Windows clients:'
mac_chrome_preferences:
desc: A text indicating in Mac OS X Workgroup Manager, that currently the preferences
of Chromium are being edited
text: <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> preferences
removed_policy_desc:
desc: Description shared by all removed policies, in Microsoft Windows' Group Policy
Editor.
text: This policy is removed. It is not compatible with this version of <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>. Read more at https://support.google.com/chrome/a/answer/7643500
removed_policy_group_caption:
desc: Localized name for the removed policies folder, for Microsoft's Group Policy
Editor.
text: Removed policies
removed_policy_group_desc:
desc: Localized description for the removed policies folder, for Microsoft's Group
Policy Editor.
text: These policies are included here to make them easy to remove.
win_supported_all:
desc: A label specifying the oldest possible compatible version of Windows. This
text will appear right next to a label containing the text 'Supported on:'.
text: Microsoft Windows 7 or later
win_supported_win7:
desc: A label specifying the policy compatibles with Windows 7. This text will appear
right next to a label containing the text 'Supported on:'.
text: Microsoft Windows 7
tools/under-control/src/components/policy/resources/templates/policies.yaml
Executable
+1368
View File
File diff suppressed because it is too large Load Diff
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/.group.details.yaml
Executable
+3
View File
@@ -0,0 +1,3 @@
caption: Accessibility settings
desc: Configure <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> accessibility
features.
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/AccessibilityShortcutsEnabled.yaml
Executable
+33
View File
@@ -0,0 +1,33 @@
caption: Enable accessibility features shortcuts
default: null
desc: |-
Enable accessibility features shortcuts.
If this policy is set to true, accessibility features shortcuts will always be enabled.
If this policy is set to false, accessibility features shortcuts will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, accessibility features shortcuts will be enabled by default.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable accessibility shortcuts
value: true
- caption: Disable accessibility shortcuts
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:81-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/AutoclickEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the autoclick accessibility feature
default: null
desc: |-
Enable the autoclick accessibility feature.
This feature is responsible to click without physically pressing your mouse or touchpad, hover over the object you'd like to click.
If this policy is set to enabled, the autoclick will always be enabled.
If this policy is set to disabled, the autoclick will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the autoclick is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable auto-click
value: true
- caption: Disable auto-click
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/CaretHighlightEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the caret highlight accessibility feature
default: null
desc: |-
Enable the caret highlight accessibility feature.
This feature is responsible for highlighting the area that surrounds the caret while editing.
If this policy is set to enabled, the caret highlight will always be enabled.
If this policy is set to disabled, the caret highlight will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the caret highlight is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable caret highlight
value: true
- caption: Disable caret highlight
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/ColorCorrectionEnabled.yaml
Executable
+35
View File
@@ -0,0 +1,35 @@
caption: Enable the color correction accessibility feature
default: null
desc: |-
Enable the color correction accessibility feature.
This feature enables users to adjust the color correction settings on their managed <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices, which may make it easier for users with color vision deficiency to perceive colors on their screen.
If this policy is set to enabled, color correction will always be enabled; users will need to go into Settings to pick their specific color correction options (e.g. Deuteranomaly/Protanomaly/Tritanamaly/Greyscale filter and intensity). Color correction settings are displayed to the user on first use.
If this policy is set to disabled, color correction will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the color correction feature is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable color correction
value: true
- caption: Disable color correction
value: false
- caption: Allow the user to decide
value: null
owners:
- katie@chromium.org
- chromeos-a11y-eng@google.com
schema:
type: boolean
supported_on:
- chrome_os:117-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/CursorHighlightEnabled.yaml
Executable
+35
View File
@@ -0,0 +1,35 @@
caption: Enable the cursor highlight accessibility feature
default: null
desc: |-
Enable the cursor highlight accessibility feature.
This feature is responsible for highlighting the area that surrounds the mouse cursor while moving it.
If this policy is set to enabled, the cursor highlight will always be enabled.
If this policy is set to disabled, the cursor highlight will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the cursor highlight is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable cursor highlight
value: true
- caption: Disable cursor highlight
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenAccessibilityShortcutsEnabled.yaml
Executable
+35
View File
@@ -0,0 +1,35 @@
caption: Enable accessibility features shortcuts on the login screen
default: null
desc: |-
Enable accessibility features shortcuts on the login screen.
If this policy is set to true, accessibility features shortcuts will always be enabled on the login screen.
If this policy is set to false, accessibility features shortcuts will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, accessibility features shortcuts will be enabled by default on the login screen.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: false
items:
- caption: Enable accessibility shortcuts on the sign-in screen
value: true
- caption: Disable accessibility shortcuts on the sign-in screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:81-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenAutoclickEnabled.yaml
Executable
+36
View File
@@ -0,0 +1,36 @@
caption: Enable autoclick on the login screen
default: null
desc: |-
Enable the autoclick accessibility feature on the login screen.
This feature allows to automatically click when the mouse cursor stops, without requiring the user to physically press the mouse or touchpad buttons.
If this policy is set to true, the autoclick will always be enabled on the login screen.
If this policy is set to false, the autoclick will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the autoclick is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable auto-click on the login screen
value: true
- caption: Disable auto-click on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenCaretHighlightEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable caret highlight on the login screen
default: null
desc: |-
Enable the caret highlight accessibility feature on the login screen.
If this policy is set to true, the caret highlight will always be enabled on the login screen.
If this policy is set to false, the caret highlight will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the caret highlight is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable caret highlight on the login screen
value: true
- caption: Disable caret highlight on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenCursorHighlightEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the cursor highlight on the login screen
default: null
desc: |-
Enable the cursor highlight accessibility feature on the login screen.
If this policy is set to true, the cursor highlight will always be enabled on the login screen.
If this policy is set to false, the cursor highlight will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the cursor highlight is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable cursor highlight on the login screen
value: true
- caption: Disable cursor highlight on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenDefaultHighContrastEnabled.yaml
Executable
+33
View File
@@ -0,0 +1,33 @@
caption: Set the default state of high contrast mode on the login screen
default: null
desc: |-
Setting the policy to True turns High-contrast mode on at the sign-in screen. Setting the policy to False turns High-contrast mode off at the screen.
If you set the policy, users can temporarily change High-contrast mode, turning it on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.
If not set, High-contrast mode is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.
Note: <ph name="DEVICE_LOGIN_SCREEN_HIGH_CONTRAST_ENABLED_POLICY_NAME">DeviceLoginScreenHighContrastEnabled</ph> overrides this policy if the former is specified.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Enable high contrast on the login screen and allow the user to temporarily
disable it
value: true
- caption: Disable high contrast on the login screen and allow the user to temporarily
enable it
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:29-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenDefaultLargeCursorEnabled.yaml
Executable
+31
View File
@@ -0,0 +1,31 @@
caption: Set default state of the large cursor on the login screen
default: null
desc: |-
Setting the policy to True turns the large cursor on at the sign-in screen. Setting the policy to False turns the large cursor off at the sign-in screen.
If you set the policy, users can temporarily turn the large cursor on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.
If not set, the large cursor is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.
Note: <ph name="DEVICE_LOGIN_SCREEN_LARGE_CURSOR_ENABLED">DeviceLoginScreenLargeCursorEnabled</ph> overrides this policy if the former is specified.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Enable large cursor on the login screen
value: true
- caption: Disable large cursor on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:29-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenDefaultScreenMagnifierType.yaml
Executable
+40
View File
@@ -0,0 +1,40 @@
caption: Set the default screen magnifier type enabled on the login screen
default: null
desc: |-
Setting the policy to None turns screen magnification off at the sign-in screen.
If you set the policy, users can temporarily turn the screen magnifier on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.
If not set, the screen magnifier is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.
Valid values: • 0 = Off • 1 = On • 2 = Docked magnifier on
Note: <ph name="DEVICE_LOGIN_SCREEN_SCREEN_MAGNIFIER_TYPE_POLICY_NAME">DeviceLoginScreenScreenMagnifierType</ph> overrides this policy if the former is specified.
device_only: true
example_value: 1
features:
dynamic_refresh: true
items:
- caption: Screen magnifier disabled
name: None
value: 0
- caption: Full-screen magnifier enabled
name: Full-screen
value: 1
- caption: Docked magnifier enabled
name: Docked
value: 2
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:29-
tags: []
type: int-enum
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenDefaultSpokenFeedbackEnabled.yaml
Executable
+33
View File
@@ -0,0 +1,33 @@
caption: Set the default state of spoken feedback on the login screen
default: null
desc: |-
Setting the policy to True turns spoken feedback on at the sign-in screen. Setting the policy to False turns spoken feedback off at the screen.
If you set the policy, users can temporarily turn spoken feedback on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.
If not set, spoken feedback is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.
Note: <ph name="DEVICE_LOGIN_SCREEN_SPOKEN_FEEDBACK_ENABLED_POLICY_NAME">DeviceLoginScreenSpokenFeedbackEnabled</ph> overrides this policy if the former is specified.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Enable spoken feedback on the login screen and allow the user to temporarily
disable it
value: true
- caption: Disable spoken feedback on the login screen and allow the user to temporarily
enable it
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:29-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenDefaultVirtualKeyboardEnabled.yaml
Executable
+36
View File
@@ -0,0 +1,36 @@
caption: Set default state of the on-screen keyboard on the login screen
default: null
deprecated: true
desc: |-
This policy is deprecated, please use the <ph name="DEVICE_LOGIN_SCREEN_VIRTUAL_KEYBOARD_ENABLED_POLICY_NAME">DeviceLoginScreenVirtualKeyboardEnabled</ph> policy instead.
Setting the policy to True turns the on-screen keyboard on at sign-in. Setting the policy to False turns the on-screen keyboard off at sign-in.
If you set the policy, users can temporarily turn the on-screen keyboard on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.
If not set, the on-screen keyboard is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.
Note: <ph name="DEVICE_LOGIN_SCREEN_VIRTUAL_KEYBOARD_ENABLED_POLICY_NAME">DeviceLoginScreenVirtualKeyboardEnabled</ph> overrides this policy if the former is specified.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Enable on-screen keyboard on the login screen and allow the user to temporarily
disable it
value: true
- caption: Disable on-screen keyboard on the login screen and allow the user to temporarily
enable it
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:34-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenDictationEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the dictation on the login screen
default: null
desc: |-
Enable the dictation accessibility feature on the login screen.
If this policy is set to true, the dictation will always be enabled on the login screen.
If this policy is set to false, the dictation will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the dictation is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable dictation on the login screen
value: true
- caption: Disable dictation on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenHighContrastEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the high contrast on the login screen
default: null
desc: |-
Enable the high contrast accessibility feature on the login screen.
If this policy is set to true, the high contrast will always be enabled on the login screen.
If this policy is set to false, the high contrast will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the high contrast is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable high contrast on the login screen
value: true
- caption: Disable high contrast on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenKeyboardFocusHighlightEnabled.yaml
Executable
+35
View File
@@ -0,0 +1,35 @@
caption: Enable the keyboard focus highlighting accessibility feature
default: null
desc: |-
Enable the keyboard focus highlighting accessibility feature on the login screen.
This feature is responsible for highlighting the object that is focused by the keyboard.
If this policy is set to enabled, the keyboard focus highlighting will always be enabled.
If this policy is set to disabled, the keyboard focus highlighting will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the keyboard focus highlighting is disabled initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable keyboard focus highlighting on the login screen
value: true
- caption: Disable keyboard focus highlighting on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenLargeCursorEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the large cursor on the login screen
default: null
desc: |-
Enable the large cursor accessibility feature on the login screen.
If this policy is set to true, the large cursor will always be enabled on the login screen.
If this policy is set to false, the large cursor will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the large cursor is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable large cursor on the login screen
value: true
- caption: Disable large cursor on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenMonoAudioEnabled.yaml
Executable
+36
View File
@@ -0,0 +1,36 @@
caption: Enable mono audio on the login screen
default: null
desc: |-
Enable the mono audio accessibility feature on the login screen.
This feature allows to switch the device mode from the default stereo audio to the mono audio.
If this policy is set to true, the mono audio will always be enabled on the login screen.
If this policy is set to false, the mono audio will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the mono audio is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable mono audio on the login screen
value: true
- caption: Disable mono audio on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenScreenMagnifierType.yaml
Executable
+43
View File
@@ -0,0 +1,43 @@
caption: Set the screen magnifier type on the login screen
default: null
desc: |-
If this policy is set, it controls the type of screen magnifier that is enabled.
If this policy is set to "Full-screen", the screen magnifier will always be enabled in full-screen magnifier mode on the login screen.
If this policy is set to "Docked", the screen magnifier will always be enabled in docked magnifier mode on the login screen.
If this policy is set to "None", the screen magnifier will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the screen magnifier is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Screen magnifier disabled
name: None
value: 0
- caption: Full-screen magnifier enabled
name: Full-screen
value: 1
- caption: Docked magnifier enabled
name: Docked
value: 2
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:79-
tags: []
type: int-enum
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenSelectToSpeakEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the select to speak on the login screen
default: null
desc: |-
Enable the select to speak accessibility feature on the login screen.
If this policy is set to true, the select to speak will always be enabled on the login screen.
If this policy is set to false, the select to speak will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the select to speak is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable select to speak on the login screen
value: true
- caption: Disable select to speak on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenShowOptionsInSystemTrayMenu.yaml
Executable
+30
View File
@@ -0,0 +1,30 @@
caption: Show accessibility options in system tray menu in the login screen
default: null
desc: |-
Setting the policy to True displays the accessibility options in the system tray menu. If you set the policy to False, the options don't appear in the menu.
If you set the policy, users can't change it. If not set, accessibility options don't appear in the menu, but users can make them appear through the Settings page.
If you turn on accessibility features by other means (for example, by key combination), accessibility options always appear in the system tray menu.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Show accessibility options in the login screen system tray menu
value: true
- caption: Hide accessibility options in the login screen system tray menu
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- bartfab@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:80-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenSpokenFeedbackEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the spoken feedback on the login screen
default: null
desc: |-
Enable the spoken feedback accessibility feature on the login screen.
If this policy is set to true, the spoken feedback will always be enabled on the login screen.
If this policy is set to false, the spoken feedback will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the spoken feedback is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable spoken feedback on the login screen
value: true
- caption: Disable spoken feedback on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenStickyKeysEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable sticky keys on the login screen
default: null
desc: |-
Enable the sticky keys accessibility feature on the login screen.
If this policy is set to true, the sticky keys will always be enabled on the login screen.
If this policy is set to false, the sticky keys will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the sticky keys is disabled on the login screen initially but can be enabled by the user anytime.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable sticky keys on the login screen
value: true
- caption: Disable sticky keys on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DeviceLoginScreenVirtualKeyboardEnabled.yaml
Executable
+36
View File
@@ -0,0 +1,36 @@
caption: Enable the accessibility virtual keyboard on the login screen
default: null
desc: |-
Enable the virtual keyboard accessibility feature on the login screen.
If this policy is set to true, the accessibility virtual keyboard will always be enabled on the login screen.
If this policy is set to false, the accessibility virtual keyboard will always be disabled on the login screen.
If you set this policy, users cannot change or override it.
If this policy is left unset, the accessibility virtual keyboard is disabled on the login screen initially but can be enabled by the user anytime via accessibility settings.
This policy does not affect whether the touch virtual keyboard is enabled. For example, the touch virtual keyboard will still show up on a tablet device even if this policy is set to false.
device_only: true
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
items:
- caption: Enable accessibility virtual keyboard on the login screen
value: true
- caption: Disable accessibility virtual keyboard on the login screen
value: false
- caption: Allow the user to decide
value: null
owners:
- shend@chromium.org
- e14s-eng@google.com
schema:
type: boolean
supported_on:
- chrome_os:79-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/DictationEnabled.yaml
Executable
+33
View File
@@ -0,0 +1,33 @@
caption: Enable the dictation accessibility feature
default: null
desc: |-
Enable the dictation accessibility feature.
If this policy is set to enabled, the dictation will always be enabled.
If this policy is set to disabled, the dictation will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the dictation is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable dictation
value: true
- caption: Disable dictation
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/EnhancedNetworkVoicesInSelectToSpeakAllowed.yaml
Executable
+26
View File
@@ -0,0 +1,26 @@
caption: Allow the enhanced network text-to-speech voices in Select-to-speak
default: true
desc: |-
Allow the enhanced network text-to-speech voices in Select-to-speak accessibility feature. These voices send text to Google's servers to synthesize natural-sounding speech.
If this policy is set to false, the enhanced network text-to-speech voices feature in Select-to-speak will always be disabled.
If this policy is set to true or unset, the enhanced network text-to-speech voices feature in Select-to-speak can be enabled or disabled by the user.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Allow enhanced network text-to-speech voices when using Select-to-Speak
value: true
- caption: Disallow enhanced network text-to-speech voices when using Select-to-Speak
value: false
owners:
- file://ui/accessibility/OWNERS
schema:
type: boolean
supported_on:
- chrome_os:94-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/FloatingAccessibilityMenuEnabled.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Enables the floating accessibility menu
default: false
desc: |-
In kiosk mode, controls whether the floating accessibility menu is being shown.
If this policy is set to enabled, the floating accessibility menu will be always shown.
If this policy is set to disabled or left unset, the floating accessibility menu will never be shown.
example_value: true
features:
dynamic_refresh: true
per_profile: true
items:
- caption: Show the floating accessibility menu in kiosk mode
value: true
- caption: Do not show the floating accessibility menu in kiosk mode
value: false
owners:
- apotapchuk@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:84-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/HighContrastEnabled.yaml
Executable
+27
View File
@@ -0,0 +1,27 @@
caption: Enable high contrast mode
default: null
desc: |-
Setting the policy to True keeps High-contrast mode on. Setting the policy to False keeps High-contrast mode off.
If you set the policy, users can't change it. If not set, High-contrast mode is off, but users can turn it on any time.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable high contrast
value: true
- caption: Disable high contrast
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:29-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/KeyboardDefaultToFunctionKeys.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Media keys default to function keys
default: false
desc: |-
Setting the policy to True makes the top row of keys on the keyboard act as function key commands. Pressing the Search key changes their behavior back to media keys.
If set to False or not set, the keyboard defaults to producing media key commands. Pressing the Search key changes them to function keys.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Treat top-row keys as function keys, but allow user to change
value: true
- caption: Treat top-row keys as media keys, but allow user to change
value: false
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:35-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/KeyboardFocusHighlightEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the keyboard focus highlighting accessibility feature
default: null
desc: |-
Enable the keyboard focus highlighting accessibility feature.
This feature is responsible for highlighting the object that has the focus by the keyboard.
If this policy is set to enabled, the keyboard focus highlighting will always be enabled.
If this policy is set to disabled, the keyboard focus highlighting will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the keyboard focus highlighting is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable keyboard focus highlighting
value: true
- caption: Disable keyboard focus highlighting
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/LargeCursorEnabled.yaml
Executable
+27
View File
@@ -0,0 +1,27 @@
caption: Enable large cursor
default: null
desc: |-
Setting the policy to True keeps the large cursor on. Setting the policy to False keeps the large cursor off.
If you set the policy, users can't change the feature. If not set, the large cursor is off at first, but users can turn it on any time.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable large cursor
value: true
- caption: Disable large cursor
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:29-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/MonoAudioEnabled.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Enable the mono audio accessibility feature
default: null
desc: |-
Enable the mono audio accessibility feature.
This feature is responsible for outputing stereo audio which includes different left and right channels, so different ears get different sounds.
If this policy is set to enabled, the mono audio will always be enabled.
If this policy is set to disabled, the mono audio will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the mono audio is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable mono audio
value: true
- caption: Disable mono audio
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:78-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/ScreenMagnifierType.yaml
Executable
+34
View File
@@ -0,0 +1,34 @@
caption: Set screen magnifier type
default: null
desc: |-
Setting the policy to None turns the screen magnifier off.
If you set the policy, users can't change it. If not set, the screen magnifier is off at first, but users can turn it on any time.
example_value: 1
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Screen magnifier disabled
name: None
value: 0
- caption: Full-screen magnifier enabled
name: Full-screen
value: 1
- caption: Docked magnifier enabled
name: Docked
value: 2
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:29-
tags: []
type: int-enum
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/SelectToSpeakEnabled.yaml
Executable
+32
View File
@@ -0,0 +1,32 @@
caption: Enable select to speak
default: null
desc: |-
Enable the select to speak accessibility feature.
If this policy is set to true, the select to speak will always be enabled.
If this policy is set to false, the select to speak will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the select to speak is disabled initially but can be enabled by the user anytime.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable select to speak
value: true
- caption: Disable select to speak
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:77-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/ShowAccessibilityOptionsInSystemTrayMenu.yaml
Executable
+29
View File
@@ -0,0 +1,29 @@
caption: Show accessibility options in system tray menu
default: null
desc: |-
Setting the policy to True displays the accessibility options in the system tray menu. If you set the policy to False, the options don't appear in the menu.
If you set the policy, users can't change it. If not set, accessibility options don't appear in the menu, but users can make them appear through the Settings page.
If you turn on accessibility features by other means (for example, by key combination), accessibility options always appear in the system tray menu.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Show accessibility options in the system tray menu
value: true
- caption: Hide accessibility options in the system tray menu
value: false
- caption: Allow the user to decide
value: null
owners:
- katie@chromium.org
- file://ui/accessibility/OWNERS
schema:
type: boolean
supported_on:
- chrome_os:27-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/SpokenFeedbackEnabled.yaml
Executable
+27
View File
@@ -0,0 +1,27 @@
caption: Enable spoken feedback
default: null
desc: |-
Setting the policy to True keeps spoken feedback on. Setting the policy to False keeps spoken feedback off.
If you set the policy, users can't change it. If not set, spoken feedback is off at first, but users can turn it on any time.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable spoken feedback
value: true
- caption: Disable spoken feedback
value: false
- caption: Allow the user to decide
value: null
owners:
- file://components/policy/OWNERS
- rsorokin@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:29-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/StickyKeysEnabled.yaml
Executable
+27
View File
@@ -0,0 +1,27 @@
caption: Enable sticky keys
default: null
desc: |-
Setting the policy to True keeps sticky keys on. Setting the policy to False keeps sticky keys off.
If you set the policy, users can't change it. If not set, sticky keys is off at first, but users can turn it on any time.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable sticky keys
value: true
- caption: Disable sticky keys
value: false
- caption: Allow the user to decide
value: null
owners:
- amraboelkher@chromium.org
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:76-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/UiAutomationProviderEnabled.yaml
Executable
+60
View File
@@ -0,0 +1,60 @@
owners:
- grt@chromium.org
- file://ui/accessibility/OWNERS
caption: Enable the browser's <ph name="UIA_NAME">UI Automation</ph> accessibility framework provider on
Windows
desc: |-
Enables the <ph name="UIA_NAME">UI Automation</ph> accessibility framework
provider in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> for use by
accessibility tools.
This policy is supported in
<ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> for a one-year
transition period to allow enterprise administrators to control the deployment
of the browser's <ph name="UIA_NAME">UI Automation</ph> accessibility
framework provider. Accessibility and other tools that use the
<ph name="UIA_NAME">UI Automation</ph> accessibility framework to interoperate
with the browser may require updates to function properly with the browser's
<ph name="UIA_NAME">UI Automation</ph> provider. Administrators can use this
policy to temporarily disable the browser's
<ph name="UIA_NAME">UI Automation</ph> provider (thereby reverting to the old
behavior) while they work with vendors to provide updates to impacted tools.
When set to false, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> only
enables its <ph name="MSAA_NAME">Microsoft Active Accessibility</ph>
provider. Accessibility and other tools that use the newer
<ph name="UIA_NAME">UI Automation</ph> accessibility framework to interoperate
with the browser will communicate with it by way of a compatibility shim in
<ph name="MS_WIN_NAME">Microsoft® Windows®</ph>.
When set to true, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>
enables its <ph name="UIA_NAME">UI Automation</ph> provider in addition to its
<ph name="MSAA_NAME">Microsoft Active Accessibility</ph> provider.
Accessibility and other tools that use the newer
<ph name="UIA_NAME">UI Automation</ph> accessibility framework to interoperate
with the browser will communicate directly with it.
When left unset, the variations framework in <ph
name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> is used to enable or disable
the provider.
Support for this policy setting will end in <ph
name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> 136.
supported_on:
- chrome.win:125-
features:
dynamic_refresh: false
per_profile: false
type: main
schema:
type: boolean
items:
- caption: Enable the <ph name="UIA_NAME">UI Automation</ph> provider.
value: true
- caption: Disable the <ph name="UIA_NAME">UI Automation</ph> provider.
value: false
- caption: The <ph name="UIA_NAME">UI Automation</ph> provider will be enabled or disabled via the variations framework.
value: null
default: null
example_value: false
tags: []
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/VirtualKeyboardEnabled.yaml
Executable
+35
View File
@@ -0,0 +1,35 @@
caption: Enable the accessibility virtual keyboard
default: null
desc: |-
Enable the virtual keyboard accessibility feature.
If this policy is set to true, the accessibility virtual keyboard will always be enabled.
If this policy is set to false, the accessibility virtual keyboard will always be disabled.
If you set this policy, users cannot change or override it.
If this policy is left unset, the accessibility virtual keyboard is disabled initially but can be enabled by the user at any time by using the accessibility settings.
This policy does not affect whether the touch virtual keyboard is enabled. For example, the touch virtual keyboard will still show up on a tablet device even if this policy is set to false. Use the <ph name="TOUCH_VIRTUAL_KEYBOARD_ENABLED_POLICY_NAME">TouchVirtualKeyboardEnabled</ph> policy to control the behavior of the touch virtual keyboard.
example_value: true
features:
can_be_recommended: true
dynamic_refresh: true
per_profile: true
items:
- caption: Enable accessibility virtual keyboard
value: true
- caption: Disable accessibility virtual keyboard
value: false
- caption: Allow the user to decide
value: null
owners:
- shend@google.com
- e14s-eng@google.com
schema:
type: boolean
supported_on:
- chrome_os:34-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Accessibility/VirtualKeyboardFeatures.yaml
Executable
+47
View File
@@ -0,0 +1,47 @@
caption: Enable or disable various features on the on-screen keyboard
desc: |-
Enable or disable various features on the on-screen keyboard. This policy takes effect only when "VirtualKeyboardEnabled" policy is enabled.
If one feature in this policy is set to True, it will be enabled on the on-screen keyboard.
If one feature in this policy is set to False or left unset, it will be disabled on the on-screen keyboard.
NOTE: this policy is only supported in PWA Kiosk mode.
example_value:
auto_complete_enabled: true
auto_correct_enabled: true
handwriting_enabled: false
spell_check_enabled: false
voice_input_enabled: false
features:
dynamic_refresh: true
per_profile: true
owners:
- anqing@chromium.org
schema:
properties:
auto_complete_enabled:
description: A boolean flag indicating if the on-screen keyboard can provide
auto-complete.
type: boolean
auto_correct_enabled:
description: A boolean flag indicating if the on-screen keyboard can provide
auto-correct.
type: boolean
handwriting_enabled:
description: A boolean flag indicating if the on-screen keyboard can provide
input via handwriting recognition.
type: boolean
spell_check_enabled:
description: A boolean flag indicating if the on-screen keyboard can provide
spell-check.
type: boolean
voice_input_enabled:
description: A boolean flag indicating if the on-screen keyboard can provide
voice input.
type: boolean
type: object
supported_on:
- chrome_os:94-
tags: []
type: dict
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/.group.details.yaml
Executable
+3
View File
@@ -0,0 +1,3 @@
caption: <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> management settings
desc: Controls settings specific to <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph>
managed <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices.
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/ChromadToCloudMigrationEnabled.yaml
Executable
+31
View File
@@ -0,0 +1,31 @@
caption: Enable the migration of Chromad devices into cloud management
deprecated: true
default: false
desc: |-
Enable the migration of <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> managed devices into cloud management. This policy allows for a remote start of a touchless migration of multiple devices in a company. Additionally, the migration will be as transparent as possible to the end users.
If this policy is enabled and the enrollment ID has already been uploaded to the DMServer, a remote device powerwash will be triggered.
If this policy is disabled or not set, the remote device powerwash is not triggered, independently of the enrollment ID upload status.
This check is triggered whenever the login screen is loaded, then retried every hour (if the device stays on the login screen). This prevents the migration from starting in the middle of a user session, causing potential problems to end users.
device_only: true
example_value: false
features:
dynamic_refresh: true
items:
- caption: Enable the migration of <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph>
managed devices into cloud management.
value: true
- caption: Disable the migration of <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph>
managed devices into cloud management.
value: false
owners:
- fsandrade@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:98-114
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/CloudAPAuthEnabled.yaml
Executable
+35
View File
@@ -0,0 +1,35 @@
caption: Allow automatic sign-in to Microsoft® cloud identity providers
default: 0
desc: |-
Configures automatic user sign-in for accounts backed by a Microsoft® cloud identity provider.
By setting this policy to 1 (<ph name="POLICY_VALUE_ENABLED">Enabled</ph>), users who sign into their computer with an account backed by a Microsoft® cloud identity provider (i.e., <ph name="MS_AAD_NAME">Microsoft® Azure® Active Directory®</ph> or the consumer Microsoft® account identity provider) or who have added a work or school account to <ph name="MS_WIN_NAME">Microsoft® Windows®</ph> can be signed into web properties using that identity automatically. Information pertaining to the user's device and account is transmitted to the user's cloud identity provider for each authentication event.
By setting this policy to 0 (<ph name="POLICY_VALUE_DISABLED">Disabled</ph>) or leaving it unset, automatic sign-in as described above is disabled.
This feature is available starting in <ph name="WIN_NAME">Microsoft® Windows®</ph> 10.
Note: This policy doesn't apply to Incognito or Guest modes.
example_value: 1
features:
dynamic_refresh: true
per_profile: false
items:
- caption: Disable Microsoft® cloud authentication
name: Disabled
value: 0
- caption: Enable Microsoft® cloud authentication
name: Enabled
value: 1
owners:
- igorruvinov@chromium.org
- file://chrome/browser/enterprise/OWNERS
schema:
enum:
- 0
- 1
type: integer
supported_on:
- chrome.win:111-
tags: []
type: int-enum
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/DeviceAuthDataCacheLifetime.yaml
Executable
+27
View File
@@ -0,0 +1,27 @@
caption: Authentication data cache lifetime
deprecated: true
default: 73
desc: |-
Setting the policy specifies in hours the authentication data cache lifetime. The cache has data about realms trusted by the machine realm (affiliated realms). So, authentication data caching helps speed up sign-in. User-specific data and data for unaffiliated realms isn't cached.
Setting the policy to 0 turns authentication data caching off. Realm-specific data is fetched on every sign-in, so turning off authentication data caching can significantly slow down user sign-in.
Leaving the policy unset means cached authentication data can be reused for up to 73 hours.
Note: Restarting the device clears the cache. Even ephemeral users' realm data is cached. Turn off the cache to prevent the tracing of an ephemeral user's realm.
device_only: true
example_value: 0
features:
dynamic_refresh: true
owners:
- fsandrade@chromium.org
schema:
maximum: 9999
minimum: 0
type: integer
supported_on:
- chrome_os:73-114
tags:
- admin-sharing
type: int
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/DeviceGpoCacheLifetime.yaml
Executable
+26
View File
@@ -0,0 +1,26 @@
caption: GPO cache lifetime
deprecated: true
default: 25
desc: |-
Setting the policy specifies in hours the Group Policy Object (GPO) cache lifetime—the maximum duration GPOs can be reused before they're redownloaded. Instead of redownloading them on every policy fetch, the system reuses cached GPOs as long as their version doesn't change.
Setting the policy to 0 turns GPO caching off. Doing this increases server load, because GPOs are redownloaded on every policy fetch, even if they didn't change.
Leaving the policy unset means cached GPOs can be reused for up to 25 hours.
Note: Restarting and signing out clears the cache.
device_only: true
example_value: 0
features:
dynamic_refresh: true
owners:
- fsandrade@chromium.org
schema:
maximum: 9999
minimum: 0
type: integer
supported_on:
- chrome_os:73-114
tags: []
type: int
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/DeviceKerberosEncryptionTypes.yaml
Executable
+43
View File
@@ -0,0 +1,43 @@
caption: Allowed Kerberos encryption types
deprecated: true
default: 1
desc: |-
Setting the policy designates which encryption types are allowed when requesting Kerberos tickets from a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> server.
Setting the policy to:
* All allows the AES encryption types aes256-cts-hmac-sha1-96 and aes128-cts-hmac-sha1-96, as well as the RC4 encryption type rc4-hmac. AES takes precedence if the server supports AES and RC4 encryption types.
* Strong or leaving it unset allows only the AES types.
* Legacy allows only the RC4 type. RC4 is insecure. It should only be needed in very specific circumstances. If possible, reconfigure the server to support AES encryption.
Also see https://wiki.samba.org/index.php/Samba_4.6_Features_added/changed#Kerberos_client_encryption_types.
device_only: true
example_value: 1
features:
dynamic_refresh: true
items:
- caption: All (insecure)
name: All
value: 0
- caption: Strong
name: Strong
value: 1
- caption: Legacy (insecure)
name: Legacy
value: 2
owners:
- fsandrade@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:66-114
tags:
- system-security
type: int-enum
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/DeviceMachinePasswordChangeRate.yaml
Executable
+27
View File
@@ -0,0 +1,27 @@
caption: Machine password change rate
deprecated: true
default: 30
desc: |-
Setting the policy specifies in days how often a client changes their machine account password. The password is randomly generated by the client and not visible to the user. Disabling this policy or setting a high number of days can negatively impact security, because it gives potential attackers more time to find and use the machine account password.
Leaving the policy unset means the machine account password is changed every 30 days.
Setting the policy to 0 turns off machine account password change.
Note: Passwords might get older than the specified number of days if the client has been offline for a longer period of time.
device_only: true
example_value: 0
features:
dynamic_refresh: true
owners:
- fsandrade@chromium.org
schema:
maximum: 9999
minimum: 0
type: integer
supported_on:
- chrome_os:66-114
tags:
- system-security
type: int
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/DeviceUserPolicyLoopbackProcessingMode.yaml
Executable
+38
View File
@@ -0,0 +1,38 @@
caption: User policy loopback processing mode
deprecated: true
default: 0
desc: |-
Setting the policy specifies whether and how user policy from computer Group Policy Object (GPO) is processed.
* Default or leaving it unset has user policy read only from user GPOs. Computer GPOs are ignored.
* Merge will merge user policy in user GPOs with that of computer GPOs. Computer GPOs take precedence.
* Replace will replace user policy in user GPOs with that of computer GPOs. User GPOs are ignored.
device_only: true
example_value: 0
features:
dynamic_refresh: true
items:
- caption: Default
name: Default
value: 0
- caption: Merge
name: Merge
value: 1
- caption: Replace
name: Replace
value: 2
owners:
- fsandrade@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:66-114
tags: []
type: int-enum
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/ActiveDirectoryManagement/policy_atomic_groups.yaml
Executable
+9
View File
@@ -0,0 +1,9 @@
ActiveDirectoryManagement:
caption: <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> management settings
policies:
- DeviceMachinePasswordChangeRate
- DeviceUserPolicyLoopbackProcessingMode
- DeviceKerberosEncryptionTypes
- DeviceGpoCacheLifetime
- DeviceAuthDataCacheLifetime
- ChromadToCloudMigrationEnabled
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/.group.details.yaml
Executable
+2
View File
@@ -0,0 +1,2 @@
caption: Android settings
desc: Controls settings for the Android container (ARC) and Android apps.
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/AppRecommendationZeroStateEnabled.yaml
Executable
+30
View File
@@ -0,0 +1,30 @@
caption: Enable App Recommendations in Zero State of Search Box
deprecated: true
desc: |-
This feature has been removed in Chrome 100.
Setting this policy to Enabled will cause recommendations for apps previously installed by the user on other devices. These recommendations will appear in the launcher after the local app recommendations, if no search text has been entered.
Setting this policy as Disabled or leaving it unset means these recommendations do not appear.
If this policy is set, users cannot change it.
example_value: true
features:
dynamic_refresh: true
per_profile: true
items:
- caption: Show app recommendations in the <ph name="PRODUCT_OS_NAME">$2<ex>Google
ChromeOS</ex></ph> launcher
value: true
- caption: Do not show app recommendations in the <ph name="PRODUCT_OS_NAME">$2<ex>Google
ChromeOS</ex></ph> launcher
value: false
owners:
- robsc@chromium.org
- bartfab@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:75-99
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcAppInstallEventLoggingEnabled.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Log events for Android app installs
default: false
desc: |-
Setting the policy to True sends reports of key, policy-triggered Android app installation events to Google.
Setting the policy to False or leaving it unset means no events are captured.
example_value: true
features:
dynamic_refresh: true
per_profile: true
items:
- caption: Android app install event logs are shared with Google
value: true
- caption: Android app install event logs are not shared with Google
value: false
owners:
- file://components/policy/OWNERS
- pastarmovj@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:67-
tags:
- google-sharing
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcAppToWebAppSharingEnabled.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Enable sharing from Android apps to Web apps
default: true
desc: |-
Setting the policy to True enables sharing text/files from Android apps to supported Web Apps, using the built-in Android sharing system.
When enabled, this will send metadata for installed Web Apps to Google to generate and install a shim Android app.
Setting the policy to False disables this functionality.
example_value: true
features:
dynamic_refresh: true
per_profile: true
items:
- caption: Enable Android to Web App sharing.
value: true
- caption: Disable Android to Web App sharing.
value: false
owners:
- tsergeant@chromium.org
- chromeos-apps-foundation-team@google.com
schema:
type: boolean
supported_on:
- chrome_os:94-
tags:
- google-sharing
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcBackupRestoreEnabled.yaml
Executable
+18
View File
@@ -0,0 +1,18 @@
caption: Enable Android Backup Service
deprecated: true
desc: This policy was removed in <ph name="PRODUCT_NAME">$2<ex>Google ChromeOS</ex></ph>
68 and replaced by <ph name="ARC_BR_POLICY_NAME">ArcBackupRestoreServiceEnabled</ph>.
example_value: false
features:
dynamic_refresh: false
per_profile: false
owners:
- file://components/policy/OWNERS
- poromov@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:53-67
tags:
- google-sharing
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcBackupRestoreServiceEnabled.yaml
Executable
+37
View File
@@ -0,0 +1,37 @@
caption: Control Android backup and restore service
default: 0
default_for_enterprise_users: 0
desc: |-
Setting the policy to <ph name="BR_ENABLED">BackupAndRestoreEnabled</ph> means Android backup and restore is initially on. Setting the policy to <ph name="BR_DISABLED">BackupAndRestoreDisabled</ph> or leaving it unset keeps backup and restore off during setup.
Setting the policy to <ph name="BR_UNDER_USER_CONTROL">BackupAndRestoreUnderUserControl</ph> means users see prompts to use backup and restore. If they turn on backup and restore, Android app data is uploaded to Android backup servers and restored during reinstallations of compatible apps.
After initial setup, users can turn backup and restore on or off.
example_value: 1
features:
dynamic_refresh: false
per_profile: false
items:
- caption: Backup and restore disabled
name: BackupAndRestoreDisabled
value: 0
- caption: User decides whether to enable backup and restore
name: BackupAndRestoreUnderUserControl
value: 1
- caption: Backup and restore enabled
name: BackupAndRestoreEnabled
value: 2
owners:
- file://components/policy/OWNERS
- anqing@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:68-
tags:
- google-sharing
type: int-enum
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcCertificatesSyncMode.yaml
Executable
+32
View File
@@ -0,0 +1,32 @@
caption: Set certificate availability for ARC-apps
default: 0
desc: |-
Setting the policy to CopyCaCerts makes all ONC-installed CA certificates with <ph name="WEB_TRUSTED_BIT">Web TrustBit</ph> available for ARC-apps.
Setting to None or leaving it unset makes <ph name="PRODUCT_OS_NAME">$2<ex>ChromeOS</ex></ph> certificates unavailable for ARC-apps.
example_value: 0
features:
dynamic_refresh: true
per_profile: false
items:
- caption: Disable usage of <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>
certificates to ARC-apps
name: SyncDisabled
value: 0
- caption: Enable <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> CA certificates
to ARC-apps
name: CopyCaCerts
value: 1
owners:
- pbond@chromium.org
- edmanp@chromium.org
schema:
enum:
- 0
- 1
type: integer
supported_on:
- chrome_os:52-
tags:
- system-security
type: int-enum
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcEnabled.yaml
Executable
+23
View File
@@ -0,0 +1,23 @@
caption: Enable ARC
default: false
default_for_enterprise_users: false
desc: Unless Ephemeral mode or multiple sign-in is on during the user's session, setting
ArcEnabled to True turns ARC on for the user. Setting the policy to False or leaving
it unset means enterprise users can't use ARC.
example_value: false
features:
dynamic_refresh: true
per_profile: false
items:
- caption: Enable ARC
value: true
- caption: Disable ARC
value: false
owners:
- pbond@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:50-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcGoogleLocationServicesEnabled.yaml
Executable
+40
View File
@@ -0,0 +1,40 @@
caption: Control Android Google location services
deprecated: true
default: 0
default_for_enterprise_users: 0
desc: |-
Warning! This policy is deprecated, please use <ph name="CROS_GLS_POLICY_NAME">GoogleLocationServicesEnabled</ph> instead. <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> now has a system location toggle, which governs the entire system including <ph name="ANDROID_NAME">Android</ph>. The <ph name="ANDROID_NAME">Android</ph> toggle is now read-only and reflects the <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> location state.
Unless the <ph name="DEFAULT_GEOLOCATION_SETTING_POLICY_NAME">DefaultGeolocationSetting</ph> policy is set to <ph name="BLOCK_GEOLOCATION_SETTING">BlockGeolocation</ph>, then setting <ph name="GLS_ENABLED">GoogleLocationServicesEnabled</ph> turns Google location services on during initial setup. Setting the policy to <ph name="GLS_DISABLED">GoogleLocationServicesDisabled</ph> or leaving it unset keeps location services off during setup.
Setting policy to <ph name="GLS_UNDER_USER_CONTROL">GoogleLocationServicesUnderUserControl</ph> prompts users about whether or not to use Google location services. If they turn it on, <ph name="ANDROID_NAME">Android</ph> apps, <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> apps, websites, and system services use the services to search the device location and send anonymous location data to Google.
After initial setup, users can turn Google location services on or off.
example_value: 1
features:
dynamic_refresh: false
per_profile: false
items:
- caption: Google location services disabled
name: GoogleLocationServicesDisabled
value: 0
- caption: User decides whether to enable Google location services
name: GoogleLocationServicesUnderUserControl
value: 1
- caption: Google location services enabled
name: GoogleLocationServicesEnabled
value: 2
owners:
- file://components/policy/OWNERS
- atwilson@chromium.org
schema:
enum:
- 0
- 1
- 2
type: integer
supported_on:
- chrome_os:68-
tags:
- google-sharing
type: int-enum
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcLocationServiceEnabled.yaml
Executable
+18
View File
@@ -0,0 +1,18 @@
caption: Enable Android Google Location Service
deprecated: true
desc: This policy was removed in <ph name="PRODUCT_NAME">$2<ex>Google ChromeOS</ex></ph>
68 and replaced by <ph name="ARC_GLS_POLICY_NAME">ArcGoogleLocationServicesEnabled</ph>.
example_value: false
features:
dynamic_refresh: false
per_profile: false
owners:
- file://components/policy/OWNERS
- emaxx@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:57-67
tags:
- google-sharing
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcOpenLinksInBrowserByDefault.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Open links in Chrome browser by default
desc: |-
Setting the policy to False allows Android apps to capture supported links by default.
Setting the policy to True make all links open in Chrome browser by default.
If the policy is not set, Android apps capture supported links by default.
default: true
default_for_enterprise_users: false
example_value: true
features:
dynamic_refresh: false
per_profile: true
items:
- caption: Open links in Chrome browser by default
value: true
- caption: Open links in Android apps by default
value: false
owners:
- cros-web-apps-team@google.com
- ovn@google.com
schema:
type: boolean
future_on:
- chrome_os
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcPolicy.yaml
Executable
+59
View File
@@ -0,0 +1,59 @@
caption: Configure ARC
desc: |-
Setting the policy specifies a set of policies to hand over to the ARC runtime. Admins can use it to select the Android apps that autoinstall. Enter value in valid JSON format.
To pin apps to the launcher, see PinnedLauncherApps.
description_schema:
properties:
applications:
items:
properties:
defaultPermissionPolicy:
description: 'Policy for granting permission requests to apps. PERMISSION_POLICY_UNSPECIFIED:
Policy not specified. If no policy is specified for a permission at
any level, then the `PROMPT` behavior is used by default. PROMPT: Prompt
the user to grant a permission. GRANT: Automatically grant a permission.
DENY: Automatically deny a permission.'
enum:
- PERMISSION_POLICY_UNSPECIFIED
- PROMPT
- GRANT
- DENY
type: string
installType:
description: 'Specifies how an app is installed. AVAILABLE: The app is
not installed automatically, but the user can install it. This is the
default if this policy is not specified. FORCE_INSTALLED: The app
is installed automatically and the user cannot uninstall it. BLOCKED:
The app is blocked and cannot be installed. If the app was installed
under a previous policy it will be uninstalled.'
enum:
- AVAILABLE
- FORCE_INSTALLED
- BLOCKED
type: string
managedConfiguration:
description: 'App-specific JSON configuration object with a set of key-value
pairs, e.g. ''"managedConfiguration": { "key1": value1, "key2": value2
}''. The keys are defined in the app manifest.'
type: object
packageName:
description: Android app identifier, e.g. "com.google.android.gm" for
Gmail
type: string
type: object
type: array
type: object
example_value: '{"applications":[{"packageName":"com.google.android.gm","installType":"FORCE_INSTALLED","defaultPermissionPolicy":"PROMPT","managedConfiguration":{}},{"packageName":"com.google.android.apps.docs","installType":"BLOCKED","defaultPermissionPolicy":"PROMPT","managedConfiguration":{}},{"packageName":"com.google.android.calculator","installType":"AVAILABLE","defaultPermissionPolicy":"PROMPT","managedConfiguration":{}}]}'
features:
dynamic_refresh: true
per_profile: false
owners:
- arc-commercial@google.com
- mhasank@chromium.org
schema:
type: string
supported_on:
- chrome_os:50-
tags: []
type: string
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/DeviceArcDataSnapshotHours.yaml
Executable
+47
View File
@@ -0,0 +1,47 @@
caption: Intervals when ARC data snapshot update process can be started for Managed
Guest Sessions
desc: 'If "DeviceArcDataSnapshotHours" policy is set, then the ARC data snapshotting
mechanism is turned on. And the ARC data snapshot update can be started automatically
during the defined time intervals. When an interval starts, ARC data snapshot update
is required and no user is logged-in, the ARC data snapshot update process is started
without user notification. If the user session is active, the UI notification is
shown and have to be accepted in order to reboot a device and start ARC data snapshot
update process. Note: a device is blocked for usage during the ARC data snapshot
update process.'
device_only: true
deprecated: true
example_value:
intervals:
- end:
day_of_week: MONDAY
time: 21720000
start:
day_of_week: MONDAY
time: 12840000
- end:
day_of_week: FRIDAY
time: 57600000
start:
day_of_week: FRIDAY
time: 38640000
timezone: GMT
features:
dynamic_refresh: true
owners:
- pbond@chromium.org
- file://components/policy/OWNERS
- atwilson@chromium.org
schema:
properties:
intervals:
items:
$ref: WeeklyTimeIntervals
type: array
timezone:
type: string
type: object
supported_on:
- chrome_os:88-113
tags: []
type: dict
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/UnaffiliatedArcAllowed.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Allow unaffiliated users to use ARC
default: true
desc: |-
Unless ARC is turned off by other means, then setting the policy to True or leaving it unset lets users use ARC. Setting the policy to False means unaffiliated users may not use ARC.
Changes to the policy only apply while ARC isn't running, for example, while starting ChromeOS.
device_only: true
example_value: false
features:
dynamic_refresh: false
items:
- caption: Allow unaffiliated users to use Android apps
value: true
- caption: Do not allow unaffiliated users to use Android apps
value: false
owners:
- arc-commercial@google.com
- mhasank@chromium.org
schema:
type: boolean
supported_on:
- chrome_os:64-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/UnaffiliatedDeviceArcAllowed.yaml
Executable
+24
View File
@@ -0,0 +1,24 @@
caption: Allow enterprise users to use ARC on unaffiliated devices.
desc: |-
Unless ARC is turned off by other means, then setting the policy to True or leaving it unset lets managed users use ARC on unaffiliated devices. Setting the policy to False means managed users may not use ARC on unaffiliated devices.
Note that other restrictions, like those imposed by ArcEnabled and UnaffiliatedArcAllowed policies, continue to be respected, and ARC gets disabled if any of them specifies so.
example_value: true
default: true
features:
dynamic_refresh: true
per_profile: false
items:
- caption: Allow users to use Android apps on unaffiliated devices
value: true
- caption: Do not allow users to use Android apps on unaffiliated devices
value: false
owners:
- arc-commercial@google.com
schema:
type: boolean
supported_on:
- chrome_os:120-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/.group.details.yaml
Executable
+2
View File
@@ -0,0 +1,2 @@
caption: Remote attestation
desc: Configure the remote attestation with TPM mechanism.
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/AttestationEnabledForDevice.yaml
Executable
+28
View File
@@ -0,0 +1,28 @@
caption: Enable remote attestation for the device
deprecated: true
default: false
desc: |-
This policy was removed in M121. It served to enable and disable Remote Attestation for the device but Remote Attestation has been enabled by default.
Setting the policy to Enabled allows remote attestation for the device. A certificate is automatically generated and uploaded to the Device Management Server.
Setting the policy to Disabled or leaving it unset means no certificate is generated and calls to the <ph name="ENTERPRISE_PLATFORM_KEYS_API">Enterprise Platform Keys API</ph> fail.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Enable remote attestation for the device
value: true
- caption: Disable remote attestation for the device
value: false
owners:
- emaxx@chromium.org
- file://chrome/browser/ash/attestation/OWNERS
schema:
type: boolean
supported_on:
- chrome_os:28-120
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/AttestationEnabledForUser.yaml
Executable
+26
View File
@@ -0,0 +1,26 @@
caption: Enable remote attestation for the user
deprecated: true
desc: |-
This policy was removed in M118. It served to enable and disable Remote Attestation for the user but Remote Attestation has been enabled by default.
Setting the policy to Enabled lets users use the hardware on <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices to remotely attest its identity to the privacy CA through the <ph name="ENTERPRISE_PLATFORM_KEYS_API">Enterprise Platform Keys API</ph> using <ph name="CHALLENGE_USER_KEY_FUNCTION">chrome.enterprise.platformKeys.challengeUserKey()</ph>.
Setting the policy to Disabled or leaving it unset has calls to the API fail with an error code.
example_value: true
features:
dynamic_refresh: true
per_profile: true
items:
- caption: Enable remote attestation for the user
value: true
- caption: Disable remote attestation for the user
value: false
owners:
- emaxx@chromium.org
- file://chrome/browser/ash/attestation/OWNERS
schema:
type: boolean
supported_on:
- chrome_os:28-117
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/AttestationExtensionAllowlist.yaml
Executable
+21
View File
@@ -0,0 +1,21 @@
caption: Extensions allowed to to use the remote attestation API
desc: |-
Setting the policy specifies the allowed extensions to use the <ph name="ENTERPRISE_PLATFORM_KEYS_API">Enterprise Platform Keys API</ph> functions for remote attestation. Extensions must be on this list to use the API.
If an extension is not in the list, or the list is not set, the call to the API fails with an error code.
example_value:
- ghdilpkmfbfdnomkmaiogjhjnggaggoi
features:
dynamic_refresh: true
per_profile: true
owners:
- emaxx@chromium.org
- file://chrome/browser/extensions/api/enterprise_platform_keys/OWNERS
schema:
items:
type: string
type: array
supported_on:
- chrome_os:87-
tags: []
type: list
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/AttestationForContentProtectionEnabled.yaml
Executable
+25
View File
@@ -0,0 +1,25 @@
caption: Enable the use of remote attestation for content protection for the device
default: true
desc: |-
Setting the policy to Enabled or leaving it unset lets <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices use remote attestation (Verified Access) to get a certificate issued by the <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> CA that asserts the device is eligible to play protected content. This process involves sending hardware endorsement information to the <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> CA which uniquely identifies the device.
Setting the policy to Disabled means the device won't use remote attestation for content protection, and the device may not play protected content.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Enable remote attestation for content protection
value: true
- caption: Disable remote attestation for content protection
value: false
owners:
- emaxx@chromium.org
- file://chrome/browser/ash/attestation/OWNERS
schema:
type: boolean
supported_on:
- chrome_os:31-
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/DeviceWebBasedAttestationAllowedUrls.yaml
Executable
+31
View File
@@ -0,0 +1,31 @@
caption: URLs that will be granted access to perform the device attestation during
SAML authentication
desc: |-
This policy configures which URLs will be granted access to use remote attestation of device identity during the SAML flow on the sign-in screen.
Specifically, if a URL matches one of the patterns provided through this policy, it will be allowed to receive a HTTP header containing a response to a remote attestation challenge, attesting device identity and device state.
If this policy is not set or is set to an empty list, no URL is allowed to use remote attestation on the sign-in screen.
URLs must have HTTPS scheme, e.g. "https://example.com".
For detailed information on valid url patterns, please see https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.
device_only: true
example_value:
- https://www.example.com/
- https://[*.]example.edu/
features:
dynamic_refresh: true
per_profile: false
owners:
- miersh@google.com
- file://chrome/browser/ash/login/OWNERS
schema:
items:
type: string
type: array
supported_on:
- chrome_os:80-
tags: []
type: list
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Attestation/policy_atomic_groups.yaml
Executable
+7
View File
@@ -0,0 +1,7 @@
Attestation:
caption: Attestation
policies:
- AttestationEnabledForDevice
- AttestationEnabledForUser
- AttestationExtensionAllowlist
- AttestationForContentProtectionEnabled
tools/under-control/src/components/policy/resources/templates/policy_definitions/Borealis/.group.details.yaml
Executable
+2
View File
@@ -0,0 +1,2 @@
caption: Borealis
desc: Controls policies related to the <ph name="BOREALIS_NAME">Borealis</ph> subsystem.
tools/under-control/src/components/policy/resources/templates/policy_definitions/Borealis/DeviceBorealisAllowed.yaml
Executable
+30
View File
@@ -0,0 +1,30 @@
caption: Allow devices to use <ph name="BOREALIS_NAME">Borealis</ph> on <ph name="PRODUCT_OS_NAME">$2<ex>Google
ChromeOS</ex></ph>
default: true
deprecated: True
desc: |-
This policy is deprecated, please use <ph name="USER_BOREALIS_ALLOWED_NAME">UserBorealisAllowed</ph> instead.
Controls the availability of <ph name="BOREALIS_NAME">Borealis</ph> for this device.
If the policy is set to false, <ph name="BOREALIS_NAME">Borealis</ph> will be unavailable for all users of the device. Otherwise (when the policy is unset, or true) <ph name="BOREALIS_NAME">Borealis</ph> will be available if and only if no other policy or setting disables it.
device_only: true
example_value: true
features:
dynamic_refresh: true
items:
- caption: Do not prevent <ph name="BOREALIS_NAME">Borealis</ph> from running on a
device
value: true
- caption: Prevent <ph name="BOREALIS_NAME">Borealis</ph> from running on a device
value: false
owners:
- philpearson@google.com
- davidriley@google.com
schema:
type: boolean
supported_on:
- chrome_os:91-110
tags: []
type: main
generate_device_proto: False
tools/under-control/src/components/policy/resources/templates/policy_definitions/Borealis/UserBorealisAllowed.yaml
Executable
+26
View File
@@ -0,0 +1,26 @@
caption: Allow users to use <ph name="BOREALIS_NAME">Borealis</ph> on <ph name="PRODUCT_OS_NAME">$2<ex>Google
ChromeOS</ex></ph>
default: true
default_for_enterprise_users: false
desc: |-
Controls the availability of <ph name="BOREALIS_NAME">Borealis</ph> for this user.
If the policy is unset, or is set to false, <ph name="BOREALIS_NAME">Borealis</ph> will be unavailable. When the policy is set to true <ph name="BOREALIS_NAME">Borealis</ph> will be available if and only if no other policy or setting disables it.
example_value: true
features:
dynamic_refresh: true
per_profile: false
items:
- caption: Allow <ph name="BOREALIS_NAME">Borealis</ph> to run for a user
value: true
- caption: Prevent <ph name="BOREALIS_NAME">Borealis</ph> from running for a user
value: false
owners:
- philpearson@google.com
- davidriley@google.com
schema:
type: boolean
supported_on:
- chrome_os:91-
tags: []
type: main
tools/under-control/src/components/policy/resources/templates/policy_definitions/BrowserEventReporting/.group.details.yaml
Executable
+2
View File
@@ -0,0 +1,2 @@
caption: Browser Event Reporting
desc: Controls settings for Browser Event Reporting.
tools/under-control/src/components/policy/resources/templates/policy_definitions/BrowserEventReporting/ReportingEndpoints.yaml
Executable
+26
View File
@@ -0,0 +1,26 @@
caption: Reporting Endpoints
default: {}
desc: |-
Allows you to configure the list of Reporting API Endpoints[1] where
enterprise reports can be sent.
[1] https://www.w3.org/TR/reporting-1/#endpoint
example_value:
endpoint-1: https://example.com
reporting-endpoint: https://reporting.example/cookie-issues
features:
dynamic_refresh: true
per_profile: true
owners:
- sandormajor@google.com
- selya@google.com
schema:
type: object
additionalProperties:
type: string
future_on:
- android
- chrome.*
- chrome_os
tags: []
type: dict
tools/under-control/src/components/policy/resources/templates/policy_definitions/BrowserEventReporting/policy_atomic_groups.yaml
Executable
+4
View File
@@ -0,0 +1,4 @@
BrowserEventReporting:
caption: Browser Event Reporting
policies:
- ReportingEndpoints
tools/under-control/src/components/policy/resources/templates/policy_definitions/BrowserIdle/.group.details.yaml
Executable
+3
View File
@@ -0,0 +1,3 @@
caption: Idle Browser Actions
desc: |-
Controls actions that run when the browser is idle.

Some files were not shown because too many files have changed in this diff Show More