Allow trusted brokers to restrict connections for spawned applications to whitelisted applications …

mojo/application/public/interfaces/application.mojom

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 module mojo;
 
 import "mojo/application/public/interfaces/service_provider.mojom";
 import "mojo/application/public/interfaces/shell.mojom";
 
 // This is the primary interface implemented by every Mojo application. It
@@ skipping 28 matching lines @@
   // parameter. This application may then request services through that
   // interface.
   //
   // It is possible that both parameters will be valid/bound if the other
   // application wants to both request services from and offer services to this
   // application.
   //
   // This application is free to ignore the |services| or |exposed_services|
   // parameters if it does not wish to offer or request services.
   //
-  // resolved_url is the URL that was requested to create this connection, after
-  // all mappings, resolutions, and redirects. This will include any querystring
-  // that was part of the request.
+  // |allowed_interfaces| is a set of interface names that the shell has
+  // determined can be exposed by this application to the connecting
+  // application. When this parameter is empty, this application should expose
+  // no services to the connecting application. When this parameter contains
+  // only the single string value "*" the application may expose all of its
+  // services to the connecting application.
+  //
+  // |resolved_url| is the URL that was requested to create this connection,
+  // after all mappings, resolutions, and redirects. This will include any
+  // querystring that was part of the request.
+  //
   AcceptConnection(string requestor_url,
                    ServiceProvider&? services,
                    ServiceProvider? exposed_services,
+                   array<string> allowed_interfaces,
                    string resolved_url);
 
   // Called by the shell in response to calling Shell's QuitApplication. The
   // application should run the callback with true if shutdown can proceed.
   // See Shell::QuitApplication for details about shutdown workflow.
   OnQuitRequested() => (bool can_quit);
 };