Add PPAPI permissions for the testing interface

chrome/browser/nacl_host/nacl_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/nacl_host/nacl_process_host.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 97 matching lines @@
       reinterpret_cast<nacl::FileDescriptor>(channel));
 #else
   nacl::FileDescriptor channel;
   channel.fd = sourceh;
   channel.auto_close = close_source;
   handles_for_sel_ldr->push_back(channel);
 #endif
   return true;
 }
 
+ppapi::PpapiPermissions GetNaClPermissions(uint32 permission_bits) {

[bbudge, 2012/12/07 22:23:41]

Good idea to restrict the permissions requested by the renderer.

+  // Only allow NaCl plugins to request certain permissions. We don't want
+  // a compromised renderer to be able to start a nacl plugin with e.g. Flash
+  // permissions which may expand the surface area of the sandbox.
+  uint32 masked_bits = permission_bits & ppapi::PERMISSION_DEV;
+  return ppapi::PpapiPermissions::GetForCommandLine(masked_bits);
+}
+
 }  // namespace
 
 struct NaClProcessHost::NaClInternal {
   std::vector<nacl::Handle> sockets_for_renderer;
   std::vector<nacl::Handle> sockets_for_sel_ldr;
 };
 
 // -----------------------------------------------------------------------------
 
 NaClProcessHost::PluginListener::PluginListener(NaClProcessHost* host)
     : host_(host) {
 }
 
 bool NaClProcessHost::PluginListener::OnMessageReceived(
     const IPC::Message& msg) {
   return host_->OnUntrustedMessageForwarded(msg);
 }
 
 NaClProcessHost::NaClProcessHost(const GURL& manifest_url,
                                  int render_view_id,
                                  uint32 permission_bits,
                                  bool off_the_record)
     : manifest_url_(manifest_url),
-      permissions_(ppapi::PpapiPermissions::GetForCommandLine(permission_bits)),
+      permissions_(GetNaClPermissions(permission_bits)),
 #if defined(OS_WIN)
       process_launched_by_broker_(false),
 #elif defined(OS_LINUX)
       wait_for_nacl_gdb_(false),
 #endif
       reply_msg_(NULL),
 #if defined(OS_WIN)
       debug_exception_handler_requested_(false),
 #endif
       internal_(new NaClInternal()),
@@ skipping 769 matching lines @@
   } else {
     NaClStartDebugExceptionHandlerThread(
         process_handle.Take(), info,
         base::MessageLoopProxy::current(),
         base::Bind(&NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker,
                    weak_factory_.GetWeakPtr()));
     return true;
   }
 }
 #endif