Update the child process security policy to use explicit permission grants.

content/browser/child_process_security_policy_impl.cc

Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 3ddd5d5e3050ec60921614ef64726eedb1a7acd2..38cf3a9985d79495983c7f6db64581a31d9c5cfb 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -49,6 +49,30 @@ const int kEnumerateDirectoryPermissions =
     kReadFilePermissions |
     base::PLATFORM_FILE_ENUMERATE;
 
+const int kReadWriteFilePermissions =
+    base::PLATFORM_FILE_OPEN |
+    base::PLATFORM_FILE_CREATE |
+    base::PLATFORM_FILE_OPEN_ALWAYS |
+    base::PLATFORM_FILE_CREATE_ALWAYS |
+    base::PLATFORM_FILE_OPEN_TRUNCATED |
+    base::PLATFORM_FILE_READ |
+    base::PLATFORM_FILE_WRITE |
+    base::PLATFORM_FILE_EXCLUSIVE_READ |
+    base::PLATFORM_FILE_EXCLUSIVE_WRITE |
+    base::PLATFORM_FILE_ASYNC |
+    base::PLATFORM_FILE_WRITE_ATTRIBUTES;
+
+const int kCreateWriteFilePermissions =
+      base::PLATFORM_FILE_CREATE |
+      base::PLATFORM_FILE_CREATE_ALWAYS |
+      base::PLATFORM_FILE_OPEN |
+      base::PLATFORM_FILE_OPEN_ALWAYS |
+      base::PLATFORM_FILE_OPEN_TRUNCATED |
+      base::PLATFORM_FILE_WRITE |
+      base::PLATFORM_FILE_WRITE_ATTRIBUTES |
+      base::PLATFORM_FILE_ASYNC;
+      // need EXCLUSIVE_WRITE in this mix?
+
 }  // namespace
 
 // The SecurityState class is used to maintain per-child process security state
@@ -408,6 +432,16 @@ void ChildProcessSecurityPolicyImpl::GrantReadFile(int child_id,
   GrantPermissionsForFile(child_id, file, kReadFilePermissions);
 }
 
+void ChildProcessSecurityPolicyImpl::GrantCreateReadWriteFile(
+    int child_id, const base::FilePath& file) {
+  GrantPermissionsForFile(child_id, file, kReadWriteFilePermissions);
+}
+
+void ChildProcessSecurityPolicyImpl::GrantCreateWriteFile(
+    int child_id, const base::FilePath& file) {
+  GrantPermissionsForFile(child_id, file, kCreateWriteFilePermissions);
+}
+
 void ChildProcessSecurityPolicyImpl::GrantReadDirectory(
     int child_id, const base::FilePath& directory) {
   GrantPermissionsForFile(child_id, directory, kEnumerateDirectoryPermissions);