certificate manager: Disable export option for TPM-backed certs.

net/base/cert_database_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 261 matching lines @@
   if (CERT_CompareName(&cert->os_cert_handle()->issuer,
                        &cert->os_cert_handle()->subject) == SECEqual) {
     return (nsstrust.sslFlags & kTrusted) == 0 &&
            (nsstrust.emailFlags & kTrusted) == 0 &&
            (nsstrust.objectSigningFlags & kTrusted) == 0;
   }
 
   return false;
 }
 
+bool CertDatabase::IsHardwareBacked(const X509Certificate* cert) const {

[Ryan Sleevi, 2012/05/21 22:08:32]

I'd prefer this method not be in CertDatabase, because CertDatabase is meant to
live on the IO thread.

IsTPMTokenReady() and GetPrivateModule() are only meant to be called on the UI
thread.

The fact that this /is/ called on the UI thread doesn't make it any safer.

See http://crbug.com/125848 for my general thoughts on this.

This also isn't "accurate" for != ChromeOS. The 'correct' function to determine
if a slot is hardware backed is to call PK11_IsHW(). However, you're passing an
|X509Certificate*|, so the real 'correct' solution is to figure out where the
/key/ lives, not where the /cert/ lives.

If the /key/ lives on a /non-exportable/ token, then we shouldn't allow the key
to be exported.

If this is kept in ChromeOS-only code (outside of the net/ layer), then sure,
this approach is 'fine' because CrOS doesn't support smart cards, but if
intended to be generic, then it's not really.

[hshi1, 2012/05/21 22:28:36]

Done.

+#if defined(OS_CHROMEOS)
+  return crypto::IsTPMTokenReady() &&
+         cert->os_cert_handle()->slot == GetPrivateModule()->os_module_handle();
+#else
+  return false;
+#endif
+}
+
 bool CertDatabase::SetCertTrust(const X509Certificate* cert,
                                 CertType type,
                                 TrustBits trust_bits) {
   bool success = psm::SetCertTrust(cert, type, trust_bits);
   if (success)
     CertDatabase::NotifyObserversOfCertTrustChanged(cert);
 
   return success;
 }
 
@@ skipping 21 matching lines @@
 
   return true;
 }
 
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net