Add external extensions json source in proper mac location.

base/file_util_posix.cc

Index: base/file_util_posix.cc
diff --git a/base/file_util_posix.cc b/base/file_util_posix.cc
index 9904584abd3c0fa9059c7ce1f276caaa9642b065..b844d77e6f8e33f2aec2fdfb3bfade4486bae217 100644
--- a/base/file_util_posix.cc
+++ b/base/file_util_posix.cc
@@ -940,4 +940,39 @@ bool CopyFile(const FilePath& from_path, const FilePath& to_path) {
 }
 #endif  // defined(OS_MACOSX)
 
+bool IsPathControlledByUser(const FilePath& base,
+                            const FilePath& path,
+                            uid_t owner_uid) {
+  if (path == base)

[Mark Mentovai, 2011/08/25 14:15:49]

This scheme seems to provide absolutely no way to verify that / doesn’t have a
preposterous mode, like 0777.

[Sam Kerner (Chrome), 2011/08/26 19:59:15]

Changed the test to include the base path, sop that '/' must pass the tests like
any other directory.

+    return true;
+
+  if (!IsPathControlledByUser(base, path.DirName(), owner_uid))
+    return false;
+
+  stat_wrapper_t stat_info;
+  if (CallStat(path.value().c_str(), &stat_info) != 0) {
+    PLOG(ERROR) << "Failed to get information on path " << path.value();
+    return false;
+  }
+
+  if (stat_info.st_uid != owner_uid) {

[TVL, 2011/08/25 14:07:28]

what happens if any segment is a link?  does that provide a vector to still let
another user control things?

[Sam Kerner (Chrome), 2011/08/26 19:59:15]

Good point.  Links are now forbidden.

+    LOG(ERROR) << "Path " << path.value()
+               << " is owned by the wrong user.";
+    return false;
+  }
+
+  if (stat_info.st_mode & S_IWOTH) {
+    LOG(ERROR) << "Path "<< path.value() << " is writable by any user.";
+    return false;
+  }
+
+  return true;

[TVL, 2011/08/25 14:07:28]

the group permissions could still be a issue, but I'm not completely sure how to
deal with that.  Hardcoding a check for the admin group might be ok here.

[Sam Kerner (Chrome), 2011/08/26 19:59:15]

Hardcoded check for the group named "admin".

+}
+
+bool IsPathControlledByAdmin(const FilePath& path) {
+  const unsigned kRootUid = 0;
+  const FilePath kFileSystemRoot("/");
+  return IsPathControlledByUser(kFileSystemRoot, path, kRootUid);
+}
+
 }  // namespace file_util