Enforce/require MOJO_HANDLE_RIGHT_TRANSFER in sending handles via MojoWriteMessage().

mojo/public/c/system/tests/core_unittest.cc

Index: mojo/public/c/system/tests/core_unittest.cc
diff --git a/mojo/public/c/system/tests/core_unittest.cc b/mojo/public/c/system/tests/core_unittest.cc
index aeba1eeb3aea1021f3ff5068ed58793b919675ce..9f0251596406322a0c7a1d0f3f67d1e96b6bb8ec 100644
--- a/mojo/public/c/system/tests/core_unittest.cc
+++ b/mojo/public/c/system/tests/core_unittest.cc
@@ -737,6 +737,36 @@ TEST(CoreTest, MAYBE_BasicSharedBuffer) {
   EXPECT_EQ(MOJO_RESULT_OK, MojoClose(h2));
 }
 
+TEST(CoreTest, MessagePipeChecksTransferRight) {
+  MojoHandle h0 = MOJO_HANDLE_INVALID;
+  MojoHandle h1 = MOJO_HANDLE_INVALID;
+  EXPECT_EQ(MOJO_RESULT_OK, MojoCreateMessagePipe(nullptr, &h0, &h1));
+
+  // Create a shared buffer (which is transferrable and duplicatable).
+  MojoHandle h_transferrable = MOJO_HANDLE_INVALID;
+  EXPECT_EQ(MOJO_RESULT_OK,
+            MojoCreateSharedBuffer(nullptr, 100, &h_transferrable));
+
+  // Make a non-transferrable duplicate handle.
+  MojoHandle h_not_transferrable = MOJO_HANDLE_INVALID;
+  EXPECT_EQ(MOJO_RESULT_OK, MojoDuplicateHandleWithReducedRights(
+                                h_transferrable, MOJO_HANDLE_RIGHT_TRANSFER,
+                                &h_not_transferrable));
+
+  // |h_transferrable| can be transferred.
+  EXPECT_EQ(MOJO_RESULT_OK, MojoWriteMessage(h0, nullptr, 0u, &h_transferrable,
+                                             1u, MOJO_WRITE_MESSAGE_FLAG_NONE));
+
+  // |h_not_transferrable| can be transferred.
+  EXPECT_EQ(MOJO_RESULT_PERMISSION_DENIED,
+            MojoWriteMessage(h0, nullptr, 0u, &h_not_transferrable, 1u,
+                             MOJO_WRITE_MESSAGE_FLAG_NONE));
+
+  EXPECT_EQ(MOJO_RESULT_OK, MojoClose(h0));
+  EXPECT_EQ(MOJO_RESULT_OK, MojoClose(h1));
+  EXPECT_EQ(MOJO_RESULT_OK, MojoClose(h_not_transferrable));
+}
+
 // This checks that things actually work in C (not C++).
 TEST(CoreTest, MinimalCTest) {
   const char* failure = MinimalCTest();