Allow trusted brokers to restrict connections for spawned applications to whitelisted applications …

mojo/application/public/cpp/lib/service_registry.cc

Index: mojo/application/public/cpp/lib/service_registry.cc
diff --git a/mojo/application/public/cpp/lib/service_registry.cc b/mojo/application/public/cpp/lib/service_registry.cc
index 911bbebae7a08d8a0db7e15061bd5a41758a9853..c11c3af1589a79f5893aaa11f5331a565e838adb 100644
--- a/mojo/application/public/cpp/lib/service_registry.cc
+++ b/mojo/application/public/cpp/lib/service_registry.cc
@@ -16,12 +16,14 @@ ServiceRegistry::ServiceRegistry(
     const std::string& connection_url,
     const std::string& remote_url,
     ServiceProviderPtr remote_services,
-    InterfaceRequest<ServiceProvider> local_services)
+    InterfaceRequest<ServiceProvider> local_services,
+    std::set<std::string> allowed_interfaces)
     : application_impl_(application_impl),
       connection_url_(connection_url),
       remote_url_(remote_url),
       local_binding_(this),
-      remote_service_provider_(remote_services.Pass()) {
+      remote_service_provider_(remote_services.Pass()),
+      allowed_interfaces_(allowed_interfaces) {
   if (local_services.is_pending())
     local_binding_.Bind(local_services.Pass());
 }
@@ -37,8 +39,11 @@ void ServiceRegistry::SetServiceConnector(ServiceConnector* connector) {
 void ServiceRegistry::SetServiceConnectorForName(
     ServiceConnector* service_connector,
     const std::string& interface_name) {
-  service_connector_registry_.SetServiceConnectorForName(service_connector,
-                                                         interface_name);
+  if (allowed_interfaces_.empty() ||

[yzshen1, 2015/07/22 17:53:58]

Please see my comment in the shell.mojom.

+      allowed_interfaces_.count(interface_name)) {
+    service_connector_registry_.SetServiceConnectorForName(service_connector,
+                                                           interface_name);
+  }
 }
 
 ServiceProvider* ServiceRegistry::GetLocalServiceProvider() {