certificate manager: Disable export option for TPM-backed certs.

chrome/browser/ui/webui/options2/certificate_manager_handler2.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/options2/certificate_manager_handler2.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/file_util.h"  // for FileAccessProvider
 #include "base/memory/scoped_vector.h"
@@ skipping 21 matching lines @@
 
 using content::BrowserThread;
 
 namespace {
 
 static const char kKeyId[] = "id";
 static const char kSubNodesId[] = "subnodes";
 static const char kNameId[] = "name";
 static const char kReadOnlyId[] = "readonly";
 static const char kUntrustedId[] = "untrusted";
+static const char kHardwareBackedId[] = "hardware_backed";

[Ryan Sleevi, 2012/05/21 22:08:32]

See other comments, but all instances of 'hardware_backed' should really be
replaced by 'extractable', since that's what you're really wanting to gate on.

The fact that it's hardware backed is orthogonal to the extractability of the
key.

In PKCS#11 terms, this is the "CKA_EXTRACTABLE" attribute.

PK11_ReadRawAttribute(PK11_TypePrivKey, |key_handle|, CKA_EXTRACABLE, ...) will
tell you this. Note that the NSS PKCS#12 functions should already be reading
this and handle it.

See
http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsPKCS12Blob....
for the NSS PSM implementation. In particular,
http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsPKCS12Blob....

[hshi1, 2012/05/21 22:28:36]

Done.

 static const char kSecurityDeviceId[] = "device";
 static const char kErrorId[] = "error";
 
 // Enumeration of different callers of SelectFile.  (Start counting at 1 so
 // if SelectFile is accidentally called with params=NULL it won't match any.)
 enum {
   EXPORT_PERSONAL_FILE_SELECTED = 1,
   IMPORT_PERSONAL_FILE_SELECTED,
   IMPORT_SERVER_FILE_SELECTED,
   IMPORT_CA_FILE_SELECTED,
@@ skipping 916 matching lines @@
         net::X509Certificate* cert = org_cert_it->get();
         cert_dict->SetString(kKeyId, CertToId(*cert));
         cert_dict->SetString(kNameId, certificate_manager_model_->GetColumnText(
             *cert, CertificateManagerModel::COL_SUBJECT_NAME));
         cert_dict->SetBoolean(
             kReadOnlyId,
             certificate_manager_model_->cert_db().IsReadOnly(cert));
         cert_dict->SetBoolean(
             kUntrustedId,
             certificate_manager_model_->cert_db().IsUntrusted(cert));
+        cert_dict->SetBoolean(
+            kHardwareBackedId,
+            certificate_manager_model_->cert_db().IsHardwareBacked(cert));
         // TODO(mattm): Other columns.
         subnodes->Append(cert_dict);
       }
       std::sort(subnodes->begin(), subnodes->end(), comparator);
 
       dict->Set(kSubNodesId, subnodes);
       nodes->Append(dict);
     }
     std::sort(nodes->begin(), nodes->end(), comparator);
 
@@ skipping 62 matching lines @@
   web_ui()->CallJavascriptFunction("CertificateManager.onCheckTpmTokenReady",
                                    ready);
 }
 #endif
 
 gfx::NativeWindow CertificateManagerHandler::GetParentWindow() const {
   return web_ui()->GetWebContents()->GetView()->GetTopLevelNativeWindow();
 }
 
 }  // namespace options2