Index: net/cert/nss_profile_filter_chromeos.cc |
diff --git a/net/cert/nss_profile_filter_chromeos.cc b/net/cert/nss_profile_filter_chromeos.cc |
index e4debce9d8b3682cda2837eb7d12fdf37fc0439b..c686a1338155e3ea06fc3a4058db605c4ca8d26a 100644 |
--- a/net/cert/nss_profile_filter_chromeos.cc |
+++ b/net/cert/nss_profile_filter_chromeos.cc |
@@ -47,9 +47,19 @@ bool NSSProfileFilterChromeOS::IsModuleAllowed(PK11SlotInfo* slot) const { |
// If this is one of the public/private slots for this profile, allow it. |
if (slot == public_slot_.get() || slot == private_slot_.get()) |
return true; |
- // If it's from the read-only slot, allow it. |
- if (PK11_IsInternalKeySlot(slot)) |
+ // If it's from the read-only slots, allow it. |
+ if (PK11_IsInternalKeySlot(slot) || |
+ slot == crypto::ScopedPK11Slot(PK11_GetInternalSlot())) |
Ryan Sleevi
2014/01/11 02:56:13
Why not PK11_IsInternal?
mattm
2014/01/11 03:23:23
PK11_IsInternal matches any of the nss software sl
Ryan Sleevi
2014/01/11 03:36:14
Yeah, but I thought they showed up as removable sl
mattm
2014/01/14 02:29:06
Ok, changed to use PK11_IsInternal && !PK11_IsRemo
|
return true; |
+ // If |public_slot_| or |private_slot_| is null, there isn't a way to get the |
+ // modules to use in the final test. |
+ if (!public_slot_.get() || !private_slot_.get()) { |
+ // Allow the root certs module which would normally be allowed by the final |
+ // test. |
+ if (PK11_HasRootCerts(slot)) |
+ return true; |
Ryan Sleevi
2014/01/11 02:56:13
This is so that roots display in the UI, right?
W
mattm
2014/01/11 03:23:23
Yeah.
Ryan Sleevi
2014/01/11 03:36:14
I was going to suggest moving it before / outside
mattm
2014/01/14 02:29:06
Done.
|
+ return false; |
+ } |
// If this is not the internal (file-system) module or the TPM module, allow |
// it. |
SECMODModule* module_for_slot = PK11_GetModule(slot); |