Avoid adding Mojo service to the utility process when running with elevated privileges.

chrome/utility/chrome_content_utility_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/utility/chrome_content_utility_client.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 179 matching lines @@
   for (Handlers::iterator it = handlers_.begin();
        !handled && it != handlers_.end(); ++it) {
     handled = (*it)->OnMessageReceived(message);
   }
 
   return handled;
 }
 
 void ChromeContentUtilityClient::RegisterMojoServices(
     content::ServiceRegistry* registry) {
+  // When the utility process is running with elevated privileges, we need to
+  // filter messages so that only a whitelist of IPCs can run. In Mojo, there's
+  // no way of filtering individual messages. Instead, we can avoid adding
+  // non-whitelisted Mojo services to the ServiceRegistry.
+  // TODO(amistry): Use a whitelist once the whistlisted IPCs have been
+  // converted to Mojo.
+  if (filter_messages_)
+    return;
+
 #if !defined(OS_ANDROID)
   registry->AddService<net::interfaces::ProxyResolverFactory>(
       base::Bind(CreateProxyResolverFactory));
   registry->AddService<ResourceUsageReporter>(
       base::Bind(CreateResourceUsageReporter));
 #endif
 }
 
 void ChromeContentUtilityClient::AddHandler(
     scoped_ptr<UtilityMessageHandler> handler) {
@@ skipping 195 matching lines @@
   safe_browsing::zip_analyzer::Results results;
   safe_browsing::dmg::AnalyzeDMGFile(
       IPC::PlatformFileForTransitToFile(dmg_file), &results);
   Send(new ChromeUtilityHostMsg_AnalyzeDmgFileForDownloadProtection_Finished(
       results));
   ReleaseProcessIfNeeded();
 }
 #endif  // defined(OS_MACOSX)
 
 #endif  // defined(FULL_SAFE_BROWSING)