Update the child process security policy to use explicit permission grants.

content/public/browser/render_view_host.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_VIEW_HOST_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_VIEW_HOST_H_
 
 #include "base/callback_forward.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/render_widget_host.h"
@@ skipping 191 matching lines @@
 
   // Causes the renderer to invoke the onbeforeunload event handler.  The
   // result will be returned via ViewMsg_ShouldClose. See also ClosePage and
   // SwapOut, which fire the PageUnload event.
   //
   // Set bool for_cross_site_transition when this close is just for the current
   // RenderView in the case of a cross-site transition. False means we're
   // closing the entire tab.
   virtual void FirePageBeforeUnload(bool for_cross_site_transition) = 0;
 
+  enum FileSelectionPermissions {

[vandebo (ex-Chrome), 2013/06/27 22:35:17]

style guide says this should go above any methods.  Considering the number of
methods here, I'm not going to push too hard if you really think it should stay
here.

[Greg Billock, 2013/06/28 18:40:33]

Yeah, that was what I was thinking. I can move it if we want to.

On 2013/06/27 22:35:17, vandebo wrote:

+    FILE_PERMISSION_READ_ONLY,
+    FILE_PERMISSION_WRITE
+  };
+
   // Notifies the Listener that one or more files have been chosen by the user
-  // from a file chooser dialog for the form. |permissions| are flags from the
-  // base::PlatformFileFlags enum which specify which file permissions should
-  // be granted to the renderer.
+  // from a file chooser dialog for the form. |permissions| is the permission
+  // security policy for the selected file.
   virtual void FilesSelectedInChooser(
       const std::vector<ui::SelectedFileInfo>& files,
-      int permissions) = 0;
+      FileSelectionPermissions permissions) = 0;
 
   virtual RenderViewHostDelegate* GetDelegate() const = 0;
 
   // Returns a bitwise OR of bindings types that have been enabled for this
   // RenderView. See BindingsPolicy for details.
   virtual int GetEnabledBindings() const = 0;
 
   virtual SiteInstance* GetSiteInstance() const = 0;
 
   // Requests the renderer to evaluate an xpath to a frame and insert css
@@ skipping 60 matching lines @@
 
  private:
   // This interface should only be implemented inside content.
   friend class RenderViewHostImpl;
   RenderViewHost() {}
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_RENDER_VIEW_HOST_H_