NSS Cros multiprofile: trust roots added by a profile shouldn't apply to other profiles.

chrome/browser/io_thread.cc

Index: chrome/browser/io_thread.cc
diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index af4638314d5caf594a42e38d32c6d9f553983766..a11b58926b5621c0f595aadb346119418cd653bc 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc
@@ -103,6 +103,11 @@
 #include "chrome/browser/net/spdyproxy/data_reduction_proxy_settings.h"
 #endif
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/net/cert_verify_proc_chromeos.h"
+#include "net/cert/multi_threaded_cert_verifier.h"
+#endif
+
 using content::BrowserThread;
 
 class SafeBrowsingURLRequestContext;
@@ -544,7 +549,13 @@ void IOThread::InitAsync() {
   globals_->system_network_delegate.reset(network_delegate);
   globals_->host_resolver = CreateGlobalHostResolver(net_log_);
   UpdateDnsClientEnabled();
+#if defined(OS_CHROMEOS)
+  // Creates a CertVerifyProc that doesn't allow any profile-provided certs.
+  globals_->cert_verifier.reset(new net::MultiThreadedCertVerifier(
+      new chromeos::CertVerifyProcChromeOS()));
+#else
   globals_->cert_verifier.reset(net::CertVerifier::CreateDefault());

[Ryan Sleevi, 2014/01/30 05:27:40]

I think you should update this to use MultiThreadedCertVerifier as well,
otherwise you're coupling lines 554/555 to the implementation details of
CreateDefault, which is non-ideal.

[mattm, 2014/02/04 05:31:21]

Done.

+#endif
   globals_->transport_security_state.reset(new net::TransportSecurityState());
 #if !defined(USE_OPENSSL)
   // For now, Certificate Transparency is only implemented for platforms