Enforce/require MOJO_HANDLE_RIGHT_TRANSFER in sending handles via MojoWriteMessage().

mojo/edk/system/handle_table.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/handle_table.h"
 
 #include <limits>
 #include <utility>
 
 #include "base/logging.h"
@@ skipping 125 matching lines @@
     if (it == handle_to_entry_map_.end()) {
       error_result = MOJO_RESULT_INVALID_ARGUMENT;
       break;
     }
 
     entries[i] = &it->second;
     if (entries[i]->busy) {
       error_result = MOJO_RESULT_BUSY;
       break;
     }
+    // Note: "Busy" is "preferred" over "permission denied".
+    if (!entries[i]->handle.has_all_rights(MOJO_HANDLE_RIGHT_TRANSFER)) {
+      error_result = MOJO_RESULT_PERMISSION_DENIED;
+      break;
+    }
     // Note: By marking the handle as busy here, we're also preventing the
     // same handle from being sent multiple times in the same message.
     entries[i]->busy = true;
 
     // Try to start the transport.
     HandleTransport transport =
         Dispatcher::HandleTableAccess::TryStartTransport(entries[i]->handle);
     if (!transport.is_valid()) {
       // Only log for Debug builds, since this is not a problem with the system
       // code, but with user code.
@@ skipping 83 matching lines @@
   for (uint32_t i = 0; i < num_handles; i++) {
     HandleToEntryMap::iterator it = handle_to_entry_map_.find(handle_values[i]);
     DCHECK(it != handle_to_entry_map_.end());
     DCHECK(it->second.busy);
     it->second.busy = false;
   }
 }
 
 }  // namespace system
 }  // namespace mojo