Enforce Capability Filter provided in manifest

This enforces the capability filter specified in an application manifest.

Note that this is mostly set to permissive right now because the capability filters as currently specified are a PITA to use. I'm going to be working with some of the security folk to devise a way to simplify this.

Committed: https://crrev.com/7569dae2853e09aa469900f354c9121ef0a09b92
Cr-Commit-Position: refs/heads/master@{#376940}

[Ben Goodger (Google), 2016-02-22 20:22:15]

Description was changed from

==========
10/ Capability Filter

BUG=
==========

to

==========
This enforces the capability filter specified in an application manifest.

Note that this is mostly set to permissive right now because the capability
filters as currently specified are a PITA to use. I'm going to be working with
some of the security folk to devise a way to simplify this.
==========

[Ben Goodger (Google), 2016-02-22 20:22:15]

ben@chromium.org changed reviewers:
+ sky@chromium.org

[sky, 2016-02-22 21:35:13]

LGTM

[Ben Goodger (Google), 2016-02-22 21:46:06]

The CQ bit was checked by ben@chromium.org

[Ben Goodger (Google), 2016-02-22 21:46:06]

The patchset sent to the CQ was uploaded after l-g-t-m from sky@chromium.org
Link to the patchset: https://codereview.chromium.org/1716793003/#ps100001
(title: ".")

[commit-bot: I haz the power, 2016-02-22 21:47:50]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1716793003/100001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1716793003/100001

[commit-bot: I haz the power, 2016-02-22 23:38:51]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-02-22 23:38:51]

Try jobs failed on following builders:
  linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Ben Goodger (Google), 2016-02-23 00:25:38]

The CQ bit was checked by ben@chromium.org

[Ben Goodger (Google), 2016-02-23 00:25:39]

The patchset sent to the CQ was uploaded after l-g-t-m from sky@chromium.org
Link to the patchset: https://codereview.chromium.org/1716793003/#ps120001
(title: ".")

[commit-bot: I haz the power, 2016-02-23 00:28:33]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1716793003/120001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1716793003/120001

[commit-bot: I haz the power, 2016-02-23 02:18:57]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-02-23 02:18:58]

Try jobs failed on following builders:
  linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Ben Goodger (Google), 2016-02-23 02:36:56]

The CQ bit was checked by ben@chromium.org

[Ben Goodger (Google), 2016-02-23 02:36:56]

The patchset sent to the CQ was uploaded after l-g-t-m from sky@chromium.org
Link to the patchset: https://codereview.chromium.org/1716793003/#ps140001
(title: ".")

[commit-bot: I haz the power, 2016-02-23 02:38:21]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1716793003/140001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1716793003/140001

[commit-bot: I haz the power, 2016-02-23 02:43:06]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-02-23 02:43:07]

Try jobs failed on following builders:
  cast_shell_linux on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/cast_shell_linu...)
  linux_chromium_clobber_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_compile_dbg_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_gn_chromeos_rel on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Ben Goodger (Google), 2016-02-23 03:51:00]

The CQ bit was checked by ben@chromium.org

[Ben Goodger (Google), 2016-02-23 03:51:01]

The patchset sent to the CQ was uploaded after l-g-t-m from sky@chromium.org
Link to the patchset: https://codereview.chromium.org/1716793003/#ps160001
(title: ".")

[commit-bot: I haz the power, 2016-02-23 03:51:08]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1716793003/160001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1716793003/160001

[commit-bot: I haz the power, 2016-02-23 03:55:26]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-02-23 03:55:29]

Try jobs failed on following builders:
  cast_shell_linux on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/cast_shell_linu...)
  linux_chromium_clobber_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_compile_dbg_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_gn_chromeos_rel on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  mac_chromium_gn_rel on tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_gn_r...)

[Ben Goodger (Google), 2016-02-23 04:51:31]

The CQ bit was checked by ben@chromium.org

[Ben Goodger (Google), 2016-02-23 04:51:32]

The patchset sent to the CQ was uploaded after l-g-t-m from sky@chromium.org
Link to the patchset: https://codereview.chromium.org/1716793003/#ps180001
(title: ".")

[commit-bot: I haz the power, 2016-02-23 04:52:13]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1716793003/180001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1716793003/180001

[commit-bot: I haz the power, 2016-02-23 06:04:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-02-23 06:04:17]

Try jobs failed on following builders:
  linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Ben Goodger (Google), 2016-02-23 06:57:06]

The CQ bit was checked by ben@chromium.org

[commit-bot: I haz the power, 2016-02-23 06:57:37]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1716793003/180001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1716793003/180001

[commit-bot: I haz the power, 2016-02-23 07:28:56]

Description was changed from

==========
This enforces the capability filter specified in an application manifest.

Note that this is mostly set to permissive right now because the capability
filters as currently specified are a PITA to use. I'm going to be working with
some of the security folk to devise a way to simplify this.
==========

to

==========
This enforces the capability filter specified in an application manifest.

Note that this is mostly set to permissive right now because the capability
filters as currently specified are a PITA to use. I'm going to be working with
some of the security folk to devise a way to simplify this.
==========

[commit-bot: I haz the power, 2016-02-23 07:28:58]

Committed patchset #10 (id:180001)

[commit-bot: I haz the power, 2016-02-23 07:30:16]

Description was changed from

==========
This enforces the capability filter specified in an application manifest.

Note that this is mostly set to permissive right now because the capability
filters as currently specified are a PITA to use. I'm going to be working with
some of the security folk to devise a way to simplify this.
==========

to

==========
This enforces the capability filter specified in an application manifest.

Note that this is mostly set to permissive right now because the capability
filters as currently specified are a PITA to use. I'm going to be working with
some of the security folk to devise a way to simplify this.

Committed: https://crrev.com/7569dae2853e09aa469900f354c9121ef0a09b92
Cr-Commit-Position: refs/heads/master@{#376940}
==========

[commit-bot: I haz the power, 2016-02-23 07:30:17]

Patchset 10 (id:??) landed as
https://crrev.com/7569dae2853e09aa469900f354c9121ef0a09b92
Cr-Commit-Position: refs/heads/master@{#376940}