Add tighter support constraints on App-Bound encryption.
This CL adds further support constraints on App-Bound encryption
out of an abundance of caution.
If the user data dir is determined to be non-standard this might
indicate enterprise override or roaming user data dir, which could
cause issues with App-Bound in certain enterprise configurations,
as it uses a machine-bound key to secure data.
These checks are now moved to the Encrypt stage of the provider,
meaning that the App-Bound encryption will not engage if the
machine is determined to be unsupported, however it will
successfully decrypt existing data if a machine moves from
a fully supported environment to an unsupported environment.
Regarding our philosophy on support of security measures in
Chrome, while it is likely that many of the configurations of
user data dir override, or network drives, would be fully supported
by App-Bound encryption will fully function, it is considered better
to have a smaller set of fully supported and protected users,
than have a larger set of users of which a very small number
might experience issues, blocking the protection from landing for
the majority of our users.
Metrics are added to measure how large these buckets are, in order
to help prioritization of whether or not to fully support them
in the future.
Tests are added to verify that the new behavior works for both
cases of varied support.
BUG=40227925
Change-Id: I3458871bb66d4417507762e3e3971b394e789093
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5413656
Commit-Queue: Will Harris <[email protected]>
Reviewed-by: Scott Violet <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1281525}
diff --git a/chrome/browser/os_crypt/BUILD.gn b/chrome/browser/os_crypt/BUILD.gn
index 90886ab..9ef8ea74 100644
--- a/chrome/browser/os_crypt/BUILD.gn
+++ b/chrome/browser/os_crypt/BUILD.gn
@@ -35,6 +35,7 @@
deps = [
"//base",
+ "//chrome/common:constants",
"//chrome/elevation_service:public_headers",
"//chrome/install_static:install_static_util",
]
