certificate manager: Disable export option for TPM-backed certs.

net/base/cert_database_nss.cc

Index: net/base/cert_database_nss.cc
diff --git a/net/base/cert_database_nss.cc b/net/base/cert_database_nss.cc
index 4dde4fcda3a06d689e32f119c48223aa575f6c5c..42bb907b75f103f83acd6cda4999a14dc0ff8337 100644
--- a/net/base/cert_database_nss.cc
+++ b/net/base/cert_database_nss.cc
@@ -279,6 +279,15 @@ bool CertDatabase::IsUntrusted(const X509Certificate* cert) const {
   return false;
 }
 
+bool CertDatabase::IsHardwareBacked(const X509Certificate* cert) const {

[Ryan Sleevi, 2012/05/21 22:08:32]

I'd prefer this method not be in CertDatabase, because CertDatabase is meant to
live on the IO thread.

IsTPMTokenReady() and GetPrivateModule() are only meant to be called on the UI
thread.

The fact that this /is/ called on the UI thread doesn't make it any safer.

See http://crbug.com/125848 for my general thoughts on this.

This also isn't "accurate" for != ChromeOS. The 'correct' function to determine
if a slot is hardware backed is to call PK11_IsHW(). However, you're passing an
|X509Certificate*|, so the real 'correct' solution is to figure out where the
/key/ lives, not where the /cert/ lives.

If the /key/ lives on a /non-exportable/ token, then we shouldn't allow the key
to be exported.

If this is kept in ChromeOS-only code (outside of the net/ layer), then sure,
this approach is 'fine' because CrOS doesn't support smart cards, but if
intended to be generic, then it's not really.

[hshi1, 2012/05/21 22:28:36]

Done.

+#if defined(OS_CHROMEOS)
+  return crypto::IsTPMTokenReady() &&
+         cert->os_cert_handle()->slot == GetPrivateModule()->os_module_handle();
+#else
+  return false;
+#endif
+}
+
 bool CertDatabase::SetCertTrust(const X509Certificate* cert,
                                 CertType type,
                                 TrustBits trust_bits) {