Allow trusted brokers to restrict connections for spawned applications to whitelisted applications …

mojo/application/public/interfaces/application.mojom

Index: mojo/application/public/interfaces/application.mojom
diff --git a/mojo/application/public/interfaces/application.mojom b/mojo/application/public/interfaces/application.mojom
index 77bf1232e95bfcff508c3b2d729d6059d66ededc..bee0f5d4e039a3ee94f3fd9bff88065571e34579 100644
--- a/mojo/application/public/interfaces/application.mojom
+++ b/mojo/application/public/interfaces/application.mojom
@@ -46,12 +46,21 @@ interface Application {
   // This application is free to ignore the |services| or |exposed_services|
   // parameters if it does not wish to offer or request services.
   //
-  // resolved_url is the URL that was requested to create this connection, after
-  // all mappings, resolutions, and redirects. This will include any querystring
-  // that was part of the request.
+  // |allowed_interfaces| is a set of interface names that the shell has
+  // determined can be exposed by this application to the connecting
+  // application. When this parameter is empty, this application is free to
+  // offer all of its services to the connecting application. When it is
+  // non-empty, this application should expose only those interfaces as the
+  // connecting application may not be trusted to access others.
+  //
+  // |resolved_url| is the URL that was requested to create this connection,
+  // after all mappings, resolutions, and redirects. This will include any
+  // querystring that was part of the request.
+  //
   AcceptConnection(string requestor_url,
                    ServiceProvider&? services,
                    ServiceProvider? exposed_services,
+                   array<string> allowed_interfaces,
                    string resolved_url);
 
   // Called by the shell in response to calling Shell's QuitApplication. The