certificate manager: Disable export option for TPM-backed certs.

chrome/browser/ui/webui/options2/certificate_manager_handler2.cc

Index: chrome/browser/ui/webui/options2/certificate_manager_handler2.cc
diff --git a/chrome/browser/ui/webui/options2/certificate_manager_handler2.cc b/chrome/browser/ui/webui/options2/certificate_manager_handler2.cc
index af91ea5ada9a421762fbdee04efefbfb1812adf8..ce09d82c51d79a159c1607d0ee47d752f19dbd87 100644
--- a/chrome/browser/ui/webui/options2/certificate_manager_handler2.cc
+++ b/chrome/browser/ui/webui/options2/certificate_manager_handler2.cc
@@ -39,6 +39,7 @@ static const char kSubNodesId[] = "subnodes";
 static const char kNameId[] = "name";
 static const char kReadOnlyId[] = "readonly";
 static const char kUntrustedId[] = "untrusted";
+static const char kHardwareBackedId[] = "hardware_backed";

[Ryan Sleevi, 2012/05/21 22:08:32]

See other comments, but all instances of 'hardware_backed' should really be
replaced by 'extractable', since that's what you're really wanting to gate on.

The fact that it's hardware backed is orthogonal to the extractability of the
key.

In PKCS#11 terms, this is the "CKA_EXTRACTABLE" attribute.

PK11_ReadRawAttribute(PK11_TypePrivKey, |key_handle|, CKA_EXTRACABLE, ...) will
tell you this. Note that the NSS PKCS#12 functions should already be reading
this and handle it.

See
http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsPKCS12Blob....
for the NSS PSM implementation. In particular,
http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsPKCS12Blob....

[hshi1, 2012/05/21 22:28:36]

Done.

 static const char kSecurityDeviceId[] = "device";
 static const char kErrorId[] = "error";
 
@@ -975,6 +976,9 @@ void CertificateManagerHandler::PopulateTree(const std::string& tab_name,
         cert_dict->SetBoolean(
             kUntrustedId,
             certificate_manager_model_->cert_db().IsUntrusted(cert));
+        cert_dict->SetBoolean(
+            kHardwareBackedId,
+            certificate_manager_model_->cert_db().IsHardwareBacked(cert));
         // TODO(mattm): Other columns.
         subnodes->Append(cert_dict);
       }