Public Sessions - prompt the user for tabCapture requests

chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

Index: chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
diff --git a/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc b/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
index ec4db9cd464dfba754cae40fd8a4cdd8b1906930..8ada0f4ebfd202438bff5c7df93514f413979936 100644
--- a/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
+++ b/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
@@ -451,9 +451,10 @@ const char* const kSafePermissionStrings[] = {
     // access to page content, which we can't allow.
     // "declarativeContent",
 
-    // Allow, but either (1) ask user for confirmation or (2) return blank
-    // capture.
-    // "desktopCapture",
+    // User is prompted when an extension requests desktopCapture whether they
+    // want to allow it. The request is made through
+    // chrome.desktopCapture.chooseDesktopMedia call.
+    "desktopCapture",
 
     // Haven't checked in detail what this does, but messing with devtools
     // usually comes with the ability to access page content.
@@ -626,9 +627,9 @@ const char* const kSafePermissionStrings[] = {
     // Enumerates removable storage.
     "system.storage",
 
-    // Provides access to screen contents, so block. Alternatively, (1) prompt
-    // for user consent or (2) return blank capture.
-    // "tabCapture",
+    // User is prompted (allow/deny) when an extension requests tabCapture. The
+    // request is made via chrome.tabCapture.capture call.
+    "tabCapture",

[miu, 2016/12/08 21:18:18]

This should be "tabCapture.capture" since the captureOffscreenTab() API is meant
to be used without any user-granted permissions. There's already been a lengthy
security discussion around this, but it'd make more sense if you take a look at
some of the records:

1. See extension API launch spreadsheet for proposal/design doc links and
privacy/security review discussion.

2. The API comments in the IDL explains some things too:
https://cs.chromium.org/chromium/src/chrome/common/extensions/api/tab_capture...

Note: captureOffscreenTab() is something we're planning on launching soon (prob
Q1).

[Ivan Šandrk, 2016/12/09 15:30:17]

This is actually fine, this whitelists all tabCapture.* things. In Public
Sessions APIs need to be explicitly whitelisted, that's what security wanted.

Just one question for you - does the new captureOffscreenTab use the same
codepath as capture? Ie. TabCaptureAccessHandler::HandleRequest. If it does -
how can I differentiate between them? If not, everything is fine :-)

[miu, 2016/12/10 00:47:20]

Same code paths, IIRC. The way you'd tell the difference: An offscreen tab will
not show up in the browser's TabStripModel, nor SessionTabHelper, nor is it
visible to the chrome.tabs APIs.

 
     // Privacy sensitive URL access.
     // "tabs",