Allow trusted brokers to restrict connections for spawned applications to whitelisted applications …

mojo/application/public/cpp/lib/service_registry.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MOJO_APPLICATION_PUBLIC_CPP_LIB_SERVICE_REGISTRY_H_
 #define MOJO_APPLICATION_PUBLIC_CPP_LIB_SERVICE_REGISTRY_H_
 
+#include <set>
 #include <string>
 
 #include "mojo/application/public/cpp/application_connection.h"
 #include "mojo/application/public/cpp/lib/service_connector_registry.h"
 #include "mojo/application/public/interfaces/service_provider.mojom.h"
 
 namespace mojo {
 
 class Application;
 class ApplicationImpl;
 
 namespace internal {
 
 // A ServiceRegistry represents each half of a connection between two
 // applications, allowing customization of which services are published to the
 // other.
 class ServiceRegistry : public ServiceProvider, public ApplicationConnection {
  public:
   ServiceRegistry();
+  // |allowed_interfaces| are the set of interfaces that the shell has allowed
+  // an application to expose to another application. If this set is empty, the

[sky, 2015/07/24 15:36:55]

Isn't allow_all only true if the set contains "*"?

+  // application is allowed to expose all of its interfaces.
   ServiceRegistry(ApplicationImpl* application_impl,
                   const std::string& connection_url,
                   const std::string& remote_url,
                   ServiceProviderPtr remote_services,
-                  InterfaceRequest<ServiceProvider> local_services);
+                  InterfaceRequest<ServiceProvider> local_services,
+                  const std::set<std::string>& allowed_interfaces);
 
   // ApplicationConnection overrides.
   void SetServiceConnector(ServiceConnector* service_connector) override;
-  void SetServiceConnectorForName(ServiceConnector* service_connector,
+  bool SetServiceConnectorForName(ServiceConnector* service_connector,
                                   const std::string& interface_name) override;
   const std::string& GetConnectionURL() override;
   const std::string& GetRemoteApplicationURL() override;
   ServiceProvider* GetServiceProvider() override;
   ServiceProvider* GetLocalServiceProvider() override;
+  void SetConnectionErrorHandler(const Closure& handler) override;
 
   void RemoveServiceConnectorForName(const std::string& interface_name);
 
  private:
   ~ServiceRegistry() override;
 
   // ApplicationConnection overrides.
   void OnCloseConnection() override;
 
   // ServiceProvider method.
   void ConnectToService(const mojo::String& service_name,
                         ScopedMessagePipeHandle client_handle) override;
 
   ApplicationImpl* application_impl_;
   const std::string connection_url_;
   const std::string remote_url_;
   Binding<ServiceProvider> local_binding_;
   ServiceProviderPtr remote_service_provider_;
   ServiceConnectorRegistry service_connector_registry_;
+  const std::set<std::string> allowed_interfaces_;
+  const bool allow_all_interfaces_;

[sky, 2015/07/24 15:36:55]

nit: As you can calculate allow_all_interfaces_ from allowed_interfaces_, and it
isn't that expensive, I would be inclined to nuke the member and instead have an
inline function allow_all_interfaces().

 
   MOJO_DISALLOW_COPY_AND_ASSIGN(ServiceRegistry);
 };
 
 }  // namespace internal
 }  // namespace mojo
 
 #endif  // MOJO_APPLICATION_PUBLIC_CPP_LIB_SERVICE_REGISTRY_H_