Update the child process security policy to use explicit permission grants.

chrome/browser/file_select_helper.cc

Index: chrome/browser/file_select_helper.cc
diff --git a/chrome/browser/file_select_helper.cc b/chrome/browser/file_select_helper.cc
index 6c44527a61e2c2519f888a5d77c6f8c3bbe30556..d63ca2498471db9f2f371cfef310be4b4936e3bc 100644
--- a/chrome/browser/file_select_helper.cc
+++ b/chrome/browser/file_select_helper.cc
@@ -9,7 +9,6 @@
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/files/file_enumerator.h"
-#include "base/platform_file.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -47,25 +46,10 @@ const int kFileSelectEnumerationId = -1;
 void NotifyRenderViewHost(RenderViewHost* render_view_host,
                           const std::vector<ui::SelectedFileInfo>& files,
                           ui::SelectFileDialog::Type dialog_type) {
-  const int kReadFilePermissions =
-      base::PLATFORM_FILE_OPEN |
-      base::PLATFORM_FILE_READ |
-      base::PLATFORM_FILE_EXCLUSIVE_READ |
-      base::PLATFORM_FILE_ASYNC;
-
-  const int kWriteFilePermissions =
-      base::PLATFORM_FILE_CREATE |
-      base::PLATFORM_FILE_CREATE_ALWAYS |
-      base::PLATFORM_FILE_OPEN |
-      base::PLATFORM_FILE_OPEN_ALWAYS |
-      base::PLATFORM_FILE_OPEN_TRUNCATED |
-      base::PLATFORM_FILE_WRITE |
-      base::PLATFORM_FILE_WRITE_ATTRIBUTES |
-      base::PLATFORM_FILE_ASYNC;
-
-  int permissions = kReadFilePermissions;
+  RenderViewHost::FileSelectionPermissions permissions =
+      RenderViewHost::FILE_PERMISSION_READ_ONLY;
   if (dialog_type == ui::SelectFileDialog::SELECT_SAVEAS_FILE)
-    permissions = kWriteFilePermissions;
+    permissions = RenderViewHost::FILE_PERMISSION_WRITE;
   render_view_host->FilesSelectedInChooser(files, permissions);
 }