owners:
- sidereal@google.com
- file://chrome/browser/ash/guest_os/OWNERS

caption: Configure Bruschetta VMs on <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>

desc: |-
  Configure installation and runtime policies for Bruschetta VMs on
  <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>. This allows for
  third-party VMs to be installed by users. This feature is disabled by default.

  This policy is a map of configuration IDs to VM configurations. When a VM is
  installed from a configuration it is persistently associated with that
  configuration ID, and any runtime policies in that configuration apply to that
  VM. Multiple VMs may be installed from the same configuration on the same device.

future_on:
- chrome_os

features:
  dynamic_refresh: true
  per_profile: false
  cloud_only: true
  unlisted: true

type: dict

schema:
  type: object
  description: Mapping from persistent IDs to VM configurations
  patternProperties:
    "[a-zA-Z0-9-_]+":
      type: object
      description: A VM configuration. Denotes a type of VM that the user can
       install, which will be persistently associated with the ID of this
       configuration, and controls that apply to this type of VM.
      required:
      - name
      - enabled_state
      properties:
        name:
          type: string
          description: User visible name for this configuration
        enabled_state:
          type: string
          description: Controls whether VMs using this configuration can be
           installed and run (<ph name="INSTALL_ALLOWED">INSTALL_ALLOWED</ph>),
           run but not installed (<ph name="RUN_ALLOWED">RUN_ALLOWED</ph>), or
           cannot be run (<ph name="BLOCKED">BLOCKED</ph>). Note that to install
           a VM the installer_image_x86_64 key must also be set. Removing a
           configuration entirely implicitly sets this to <ph name="BLOCKED">BLOCKED</ph>,
           preventing VMs from running without a policy.
          enum:
          - BLOCKED
          - RUN_ALLOWED
          - INSTALL_ALLOWED
        installer_image_x86_64:
          type: object
          description: The UEFI-bootable disk image used to install the VM on x86_64 devices.
          required:
          - url
          - hash
          properties:
            url:
              type: string
              description: URL of the disk image to download.
            hash:
              type: string
              description: Hexadecimal encoded SHA-256 hash of the disk image.
        uefi_pflash_x86_64:
          type: object
          description: The initial non-volatile UEFI data used by the VM firmware.
          required:
          - url
          - hash
          properties:
            url:
              type: string
              description: URL of the data to download.
            hash:
              type: string
              description: Hexadecimal encoded SHA-256 hash of the data.
        vtpm:
          type: object
          description: Controls if VMs using this configuration have
           access to a vTPM, defaults to false and
           <ph name="FORCE_SHUTDOWN_IF_MORE_RESTRICTED">FORCE_SHUTDOWN_IF_MORE_RESTRICTED</ph>
           if unset.
          required:
          - enabled
          properties:
            enabled:
              type: boolean
              description: Controls whether VMs using this configuration have
               access to a vTPM, defaults to false.
            policy_update_action:
              type: string
              description: Controls how to treat running VMs that don't match
               this policy setting, defaults to
               <ph name="FORCE_SHUTDOWN_IF_MORE_RESTRICTED">FORCE_SHUTDOWN_IF_MORE_RESTRICTED</ph>.
              enum:
              - NONE
              - FORCE_SHUTDOWN_IF_MORE_RESTRICTED
              - FORCE_SHUTDOWN_ALWAYS
        oem_strings:
          type: array
          description: SMBIOS OEM strings to pass to the VM during install.
           Defaults to the empty list.
          items:
            type: string
        display_order:
          type: integer
          description: The order in which the VM configuration will be displayed in the installer.
           When multiple VM configurations are specified, the one with the smallest display_order
           value is displayed at the top of the list. Defaults to zero.

example_value:
  vm-type:
    name: Standard Virtual Machine
    enabled_state: INSTALL_ALLOWED
    installer_image_x86_64:
      url: https://example.com/installer_image
      hash: 761b22509ee7bd3e1a3da9eb9e37c6443acfc582670b733601ca5a1de44b99de
    uefi_pflash_x86_64:
      url: https://example.com/uefi_pflash
      hash: 4d9a81e8feb96abb6da0d92642996a26edea6e94345da12a19999470c57bb0a6
    vtpm:
      enabled: true
      policy_update_action: NONE
    oem_strings:
      - example config string
    display_order: 5

tags:
 - system-security
