Add rights for get/set options. Update message pipe and data pipe APIs.

mojo/public/c/system/message_pipe.h

Index: mojo/public/c/system/message_pipe.h
diff --git a/mojo/public/c/system/message_pipe.h b/mojo/public/c/system/message_pipe.h
index cc57d8cd26a75eebf2feba09102b375292ccc25f..ea3dcc30e4a505b742d20faaff291e44f01799aa 100644
--- a/mojo/public/c/system/message_pipe.h
+++ b/mojo/public/c/system/message_pipe.h
@@ -63,7 +63,10 @@ MOJO_BEGIN_EXTERN_C
 // |options| may be set to null for a message pipe with the default options.
 //
 // On success, |*message_pipe_handle0| and |*message_pipe_handle1| are set to
-// handles for the two endpoints (ports) for the message pipe.
+// handles for the two endpoints (ports) for the message pipe. Both handles have
+// (at least) the following rights: |MOJO_HANDLE_RIGHT_TRANSFER|,
+// |MOJO_HANDLE_RIGHT_READ|, |MOJO_HANDLE_RIGHT_WRITE|,
+// |MOJO_HANDLE_RIGHT_GET_OPTIONS|, and |MOJO_HANDLE_RIGHT_SET_OPTIONS|.
 //
 // Returns:
 //   |MOJO_RESULT_OK| on success.
@@ -78,22 +81,25 @@ MojoResult MojoCreateMessagePipe(
     MojoHandle* MOJO_RESTRICT message_pipe_handle1);  // Out.
 
 // |MojoWriteMessage()|: Writes a message to the message pipe endpoint given by
-// |message_pipe_handle|, with message data specified by |bytes| of size
-// |num_bytes| and attached handles specified by |handles| of count
-// |num_handles|, and options specified by |flags|. If there is no message data,
-// |bytes| may be null, in which case |num_bytes| must be zero. If there are no
-// attached handles, |handles| may be null, in which case |num_handles| must be
-// zero.
+// |message_pipe_handle| (which must have the |MOJO_HANDLE_RIGHT_WRITE| right),
+// with message data specified by |bytes| of size |num_bytes| and attached
+// handles specified by |handles| of count |num_handles|, and options specified
+// by |flags|. If there is no message data, |bytes| may be null, in which case
+// |num_bytes| must be zero. If there are no attached handles, |handles| may be
+// null, in which case |num_handles| must be zero.
 //
 // If handles are attached, on success the handles will no longer be valid (the
 // receiver will receive equivalent, but logically different, handles). Handles
-// to be sent should not be in simultaneous use (e.g., on another thread).
+// to be sent should not be in simultaneous use (e.g., on another thread). On
+// failure, any handles to be attached will remain valid.
 //
 // Returns:
 //   |MOJO_RESULT_OK| on success (i.e., the message was enqueued).
 //   |MOJO_RESULT_INVALID_ARGUMENT| if some argument was invalid (e.g., if
 //       |message_pipe_handle| is not a valid handle, or some of the
 //       requirements above are not satisfied).
+//   |MOJO_RESULT_PERMISSION_DENIED| if |message_pipe_handle| does not have the
+//       |MOJO_HANDLE_RIGHT_WRITE| right.
 //   |MOJO_RESULT_RESOURCE_EXHAUSTED| if some system limit has been reached, or
 //       the number of handles to send is too large (TODO(vtl): reconsider the
 //       latter case).
@@ -116,12 +122,13 @@ MojoResult MojoWriteMessage(MojoHandle message_pipe_handle,  // In.
                             uint32_t num_handles,            // In.
                             MojoWriteMessageFlags flags);    // In.
 
-// |MojoReadMessage()|: Reads the next message from a message pipe, or indicates
-// the size of the message if it cannot fit in the provided buffers. The message
-// will be read in its entirety or not at all; if it is not, it will remain
-// enqueued unless the |MOJO_READ_MESSAGE_FLAG_MAY_DISCARD| flag was passed. At
-// most one message will be consumed from the queue, and the return value will
-// indicate whether a message was successfully read.
+// |MojoReadMessage()|: Reads the next message from the message pipe endpoint
+// given by |message_pipe_handle| (which must have the |MOJO_HANDLE_RIGHT_READ|
+// right) or indicates the size of the message if it cannot fit in the provided
+// buffers. The message will be read in its entirety or not at all; if it is
+// not, it will remain enqueued unless the |MOJO_READ_MESSAGE_FLAG_MAY_DISCARD|
+// flag was passed. At most one message will be consumed from the queue, and the
+// return value will indicate whether a message was successfully read.
 //
 // |num_bytes| and |num_handles| are optional in/out parameters that on input
 // must be set to the sizes of the |bytes| and |handles| arrays, and on output
@@ -140,6 +147,8 @@ MojoResult MojoWriteMessage(MojoHandle message_pipe_handle,  // In.
 //   |MOJO_RESULT_OK| on success (i.e., a message was actually read).
 //   |MOJO_RESULT_INVALID_ARGUMENT| if some argument was invalid.
 //   |MOJO_RESULT_FAILED_PRECONDITION| if the other endpoint has been closed.
+//   |MOJO_RESULT_PERMISSION_DENIED| if |message_pipe_handle| does not have the
+//       |MOJO_HANDLE_RIGHT_READ| right.
 //   |MOJO_RESULT_RESOURCE_EXHAUSTED| if the message was too large to fit in the
 //       provided buffer(s). The message will have been left in the queue or
 //       discarded, depending on flags.