Make Isolated file system writable only if it is configured so

webkit/fileapi/isolated_context.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef WEBKIT_FILEAPI_ISOLATED_CONTEXT_H_
 #define WEBKIT_FILEAPI_ISOLATED_CONTEXT_H_
 
 #include <map>
 #include <set>
 #include <string>
@@ skipping 59 matching lines @@
   // |virtual_path| has no <relative_path> part (i.e. pointing to
   // the virtual root).
   bool CrackIsolatedPath(const FilePath& virtual_path,
                          std::string* filesystem_id,
                          FilePath* root_path,
                          FilePath* platform_path) const;
 
   // Returns a vector of the full paths of the top-level entry paths
   // registered for the |filesystem_id|.  Returns false if the
   // |filesystem_is| is not valid.
-  bool GetTopLevelPaths(std::string filesystem_id,
+  bool GetTopLevelPaths(const std::string& filesystem_id,
                         std::vector<FilePath>* paths) const;
 
   // Returns the virtual path that looks like /<filesystem_id>/<relative_path>.
   FilePath CreateVirtualPath(const std::string& filesystem_id,
                              const FilePath& relative_path) const;
 
+  // Set the filesystem writable if |writable| is true, non-writable
+  // if it is false. Returns false if the |filesystem_id| is not valid.
+  bool SetWritable(const std::string& filesystem_id, bool writable);
+
+  // Returns true if the |filesystem_id| is writable.
+  bool IsWritable(const std::string& filesystem_id) const;
+
  private:
   friend struct base::DefaultLazyInstanceTraits<IsolatedContext>;
 
   // Maps from filesystem id to a path conversion map for top-level entries.
   typedef std::map<FilePath, FilePath> PathMap;
   typedef std::map<std::string, PathMap> IDToPathMap;
 
   // Obtain an instance of this class via GetInstance().
   IsolatedContext();
   ~IsolatedContext();
 
   // Returns a new filesystem_id.  Called with lock.
   std::string GetNewFileSystemId() const;
 
   // This lock needs to be obtained when accessing the toplevel_map_.
   mutable base::Lock lock_;
 
   // Maps the toplevel entries to the filesystem id.
   IDToPathMap toplevel_map_;
 
+  // Holds a set of writable ids.
+  // Isolated file systems are created read-only by default, and this set
+  // holds a list of exceptions.
+  // Detailed filesystem permission may be provided by an external
+  // security policy manager, e.g. ChildProcessSecurityPolicy.
+  std::set<std::string> writable_ids_;
+
   DISALLOW_COPY_AND_ASSIGN(IsolatedContext);
 };
 
 }  // namespace fileapi
 
 #endif  // WEBKIT_FILEAPI_ISOLATED_CONTEXT_H_