Instructions for use in Chromium

[davidp3]

Hi, we're looking into integrating this SDK into Firefox. I understand that the SDK is currently available in Chromium -- are there written instructions for configuring Chromium to consult an agent? Does it work with the demo agent? It will be very helpful to see this running.

[rogerta]

Hi David, chromium does work with the demo agent. There are currently no instructions but let me write some up and share here shortly. Thanks.

[rogerta]

Content analysis is a Google Chrome enterprise feature which is available on browsers enrolled with Chrome Browser Cloud Management (CBCM). However it is possible to build the Chromium browser on Microsoft Windows with a specific patch to enable the feature without CBCM.

Step 1 - Build the Demo Agent

Follow the instructions of the Google Chrome Content Analysis Connector Agent SDK to get and build the SDK and demo agent on Microsoft Windows.

Step 2 - Run the Demo Agent

The demo agent is a simple command line program that receives content analysis requests from the browser and responds with “allow” or “ deny”. It differs from a real agent in the following ways:

• It does not display a UX to the user when the content is blocked. This is an important function of a real agent which is left out of the demo for simplicity.
• It is not configurable. Content with the word “block” will be denied. All other content is allowed.
  • Specifically for the Print use case, a page to be printed at a URL containing the word “block” is denied. All others are allowed.
  • Parsing for the word “block” is done as a simple text search, so complex file formats likely won’t work properly.

Open a Command Prompt and run the agent as follows:

C:\src\sdk> .\build\debug\agent.exe --path=path_system
[Demo] AgentWin{pipe="\\.\pipe\path_system" stop=00000000000000B4
conn@0{handle=0000000000000104 connected=false pid=0 rsize=0 fsize=0}
conn@1{handle=000000000000010C connected=false pid=0 rsize=0 fsize=0}}

The most important part to verify in the output above is the string pipe="\\.\pipe\path_system". Run the agent with --help for other options.

Step 3 - Build Chromium

Follow the Chromium developer instructions for getting and building Chromium on Microsoft Windows and make sure it runs correctly.

Apply the following patch to the source code and rebuild:

diff --git a/chrome/browser/enterprise/connectors/connectors_manager.cc b/chrome/browser/enterprise/connectors/connectors_manager.cc
index 667056860943b..ec23d3627297a 100644
--- a/chrome/browser/enterprise/connectors/connectors_manager.cc
+++ b/chrome/browser/enterprise/connectors/connectors_manager.cc
@@ -8,6 +8,7 @@

 #include "base/check.h"
 #include "base/feature_list.h"
+#include "base/json/json_reader.h"
 #include "base/values.h"
 #include "build/chromeos_buildflags.h"
 #include "chrome/browser/enterprise/connectors/analysis/content_analysis_features.h"
@@ -38,21 +39,7 @@ ConnectorsManager::ConnectorsManager(
 ConnectorsManager::~ConnectorsManager() = default;

 bool ConnectorsManager::IsConnectorEnabled(AnalysisConnector connector) const {
-  if (analysis_connector_settings_.count(connector) == 0 &&
-      prefs()->HasPrefPath(ConnectorPref(connector))) {
-    CacheAnalysisConnectorPolicy(connector);
-  }
-
-  if (analysis_connector_settings_.count(connector) != 1) {
-    return false;
-  }
-
-  // If the connector is for local content analysis, make sure it is also
-  // enabled by flags.  For now, only one connector is supported at a time.
-  const auto& settings = analysis_connector_settings_.at(connector)[0];
-
-  return settings.is_cloud_analysis() ||
-         base::FeatureList::IsEnabled(kLocalContentAnalysisEnabled);
+  return true;
 }

 bool ConnectorsManager::IsConnectorEnabled(ReportingConnector connector) const {
@@ -145,14 +132,14 @@ void ConnectorsManager::CacheAnalysisConnectorPolicy(
     AnalysisConnector connector) const {
   analysis_connector_settings_.erase(connector);

-  // Connectors with non-existing policies should not reach this code.
-  const char* pref = ConnectorPref(connector);
-  DCHECK(pref);
-
-  const base::Value::List& policy_value = prefs()->GetList(pref);
-  for (const base::Value& service_settings : policy_value)
-    analysis_connector_settings_[connector].emplace_back(
-        service_settings, *service_provider_config_);
+  absl::optional<base::Value> service_settings = base::JSONReader::Read(R"({
+          "service_provider": "local_system_agent",
+          "block_until_verdict": 1,
+          "minimum_data_size": 1,
+          "enable": [{"url_list": ["*"], "tags": ["dlp"]}]
+        })");
+  analysis_connector_settings_[connector].emplace_back(
+      service_settings.value(), *service_provider_config_);
 }

 void ConnectorsManager::CacheReportingConnectorPolicy(

Step 4 - Run Chromium

By default CBCM and content analysis are not enabled in Chromium. Run Chromium as follows:

C:\src\chromium> .\out\Default\chrome.exe --enable-chrome-browser-cloud-management --enable-features=EnablePrintContentAnalysis

Chromium should connect to the agent on startup. Verify that the agent has detected the browser by looking for a message similar to the following in its Command Prompt window:

Browser connected pid=124844 path=C:\src\chromium\src\out\Default\chrome.exe

Step 5 - Perform User Actions

User actions that will trigger content analysis are:

• Pasting text, images, or files into a web page
• Clicking a download link on a web page
• Using a file dialog to attach files to a web page
• Printing a web page

Verify that the demo agent is correctly receiving content analysis requests from Chromium by looking for output similar to the following in its Command Prompt window:

Request: 2772D3A619770C94B44DC4F3A5CE6EB457A5BB3BACCB50CA8679F4AD920DA2265F8426FD7327680E9C2F7F51089C7398F0FB57C954525B762FE4D4005501EBF4D839F6A6D61E5A93F86E793F8B795F90E1864A48E87BDB8A731A856D809E8F97AA80C6DC1912B9266113DF9F64824F656FD0D4B92D54D3927DC6D96E20CED998
  User action ID: 380AD71119DB28830F0B79954C1A6FD6B0449C5A01A557BE47502E2CEA5308BC4BBC59D4BDC094083911AAA705E68534164421C954614B07C70CA24018E5A49B8BA1964AA1C74703F167CDF6EDD3E9C735E2D1808B37DF48272E868FFF44B51320F972B5878887A211830FF04D0F2CD3684AEA798C59F3D030357513B72C85DE
  Expires at: Fri Mar 10 18:00:34 2023
  Connector: bulk-data-entry
  URL: http://google.ca
  Tab title: Google
  Filename: <No filename>
  Digest: <No digest>
  Filepath: None, bulk text entry or print
  Machine user: GOOGLE\rogerta
  Email:
  Verdict: allow

Ack: 2772D3A619770C94B44DC4F3A5CE6EB457A5BB3BACCB50CA8679F4AD920DA2265F8426FD7327680E9C2F7F51089C7398F0FB57C954525B762FE4D4005501EBF4D839F6A6D61E5A93F86E793F8B795F90E1864A48E87BDB8A731A856D809E8F97AA80C6DC1912B9266113DF9F64824F656FD0D4B92D54D3927DC6D96E20CED998
  Final action: Allow

[davidp3]

Thanks, Roger, that is exactly what I was looking for.

[aboodic]

diff --git a/chrome/browser/enterprise/connectors/connectors_manager.cc b/chrome/browser/enterprise/connectors/connectors_manager.cc
index 667056860943b..ec23d3627297a 100644
--- a/chrome/browser/enterprise/connectors/connectors_manager.cc
+++ b/chrome/browser/enterprise/connectors/connectors_manager.cc
@@ -8,6 +8,7 @@

#include "base/check.h"
#include "base/feature_list.h"
+#include "base/json/json_reader.h"
#include "base/values.h"
#include "build/chromeos_buildflags.h"
#include "chrome/browser/enterprise/connectors/analysis/content_analysis_features.h"
@@ -38,21 +39,7 @@ ConnectorsManager::ConnectorsManager(
ConnectorsManager::~ConnectorsManager() = default;

bool ConnectorsManager::IsConnectorEnabled(AnalysisConnector connector) const {

• if (analysis_connector_settings_.count(connector) == 0 &&

•  prefs()->HasPrefPath(ConnectorPref(connector))) {
  

• CacheAnalysisConnectorPolicy(connector);
• }
• if (analysis_connector_settings_.count(connector) != 1) {
• return false;
• }
• // If the connector is for local content analysis, make sure it is also
• // enabled by flags. For now, only one connector is supported at a time.
• const auto& settings = analysis_connector_settings_.at(connector)[0];
• return settings.is_cloud_analysis() ||

•     base::FeatureList::IsEnabled(kLocalContentAnalysisEnabled);
  

• return true;
  }

bool ConnectorsManager::IsConnectorEnabled(ReportingConnector connector) const {
@@ -145,14 +132,14 @@ void ConnectorsManager::CacheAnalysisConnectorPolicy(
AnalysisConnector connector) const {
analysis_connector_settings_.erase(connector);

• // Connectors with non-existing policies should not reach this code.
• const char* pref = ConnectorPref(connector);
• DCHECK(pref);
• const base::Value::List& policy_value = prefs()->GetList(pref);
• for (const base::Value& service_settings : policy_value)
• analysis_connector_settings_[connector].emplace_back(

•    service_settings, *service_provider_config_);
  

• absl::optionalbase::Value service_settings = base::JSONReader::Read(R"({

•      "service_provider": "local_system_agent",
  

•      "block_until_verdict": 1,
  

•      "minimum_data_size": 1,
  

•      "enable": [{"url_list": ["*"], "tags": ["dlp"]}]
  

•    })");
  

• analysis_connector_settings_[connector].emplace_back(

•  service_settings.value(), *service_provider_config_);
  

}

void ConnectorsManager::CacheReportingConnectorPolicy(

[aboodic]

C:\src\chromium> .\out\Default\chrome.exe --enable-chrome-browser-cloud-management --enable-features=EnablePrintContentAnalysis