Packaged (CRX) extensions shouldn't be able to get 'dev' interfaces in NaCl.

chrome/renderer/chrome_content_renderer_client.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_RENDERER_CHROME_CONTENT_RENDERER_CLIENT_H_
 #define CHROME_RENDERER_CHROME_CONTENT_RENDERER_CLIENT_H_
 #pragma once
 
 #include <string>
 
@@ skipping 109 matching lines @@
       int message_id,
       bool is_blocked_for_prerendering,
       bool allow_loading);
 
   // Returns true if the frame is navigating to an URL either into or out of an
   // extension app's extent.
   bool CrossesExtensionExtents(WebKit::WebFrame* frame,
                                const GURL& new_url,
                                bool is_initial_navigation);
 
+  // Returns true if the NaCl plugin can be created. If it returns true, as a
+  // side effect, it may add special attributes to params.
+  bool IsNaClAllowed(const webkit::WebPluginInfo& plugin,
+                     const GURL& url,
+                     const std::string& actual_mime_type,
+                     bool enable_nacl,
+                     WebKit::WebPluginParams& params);
+
   scoped_ptr<ChromeRenderProcessObserver> chrome_observer_;
   scoped_ptr<ExtensionDispatcher> extension_dispatcher_;
   scoped_ptr<RendererHistogramSnapshots> histogram_snapshots_;
   scoped_ptr<RendererNetPredictor> net_predictor_;
   scoped_ptr<SpellCheck> spellcheck_;
   // The SpellCheckProvider is a RenderViewObserver, and handles its own
   // destruction.
   SpellCheckProvider* spellcheck_provider_;
   scoped_ptr<VisitedLinkSlave> visited_link_slave_;
   scoped_ptr<safe_browsing::PhishingClassifierFilter> phishing_classifier_;
 };
 
 }  // namespace chrome
 
 #endif  // CHROME_RENDERER_CHROME_CONTENT_RENDERER_CLIENT_H_