Adding a DownloadRestrictions group policy.

content/public/browser/download_item.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Each download is represented by a DownloadItem, and all DownloadItems
 // are owned by the DownloadManager which maintains a global list of all
 // downloads. DownloadItems are created when a user initiates a download,
 // and exist for the duration of the browser life time.
 //
 // Download observers:
@@ skipping 60 matching lines @@
 
     // This state indicates that the download has been interrupted.
     INTERRUPTED,
 
     // Maximum value.
     MAX_DOWNLOAD_STATE
   };
 
   // How the final target path should be used.
   enum TargetDisposition {
-    TARGET_DISPOSITION_OVERWRITE, // Overwrite if the target already exists.
-    TARGET_DISPOSITION_PROMPT     // Prompt the user for the actual
-                                  // target. Implies
-                                  // TARGET_DISPOSITION_OVERWRITE.
+    TARGET_DISPOSITION_OVERWRITE,  // Overwrite if the target already exists.
+    TARGET_DISPOSITION_PROMPT      // Prompt the user for the actual
+                                   // target. Implies
+                                   // TARGET_DISPOSITION_OVERWRITE.
   };
 
   // Callback used with AcquireFileAndDeleteDownload().
   typedef base::Callback<void(const base::FilePath&)> AcquireFileCallback;
 
   // Used to represent an invalid download ID.
   static const uint32_t kInvalidId;
 
   // Interface that observers of a particular download must implement in order
   // to receive updates to the download's status.
@@ skipping 333 matching lines @@
   // renderer.
   virtual WebContents* GetWebContents() const = 0;
 
   // External state transitions/setters ----------------------------------------
 
   // TODO(rdsmith): These should all be removed; the download item should
   // control its own state transitions.
 
   // Called if a check of the download contents was performed and the results of
   // the test are available. This should only be called after AllDataSaved() is
-  // true.
-  virtual void OnContentCheckCompleted(DownloadDangerType danger_type) = 0;
+  // true. If |reason| is not DOWNLOAD_INTERRUPT_REASON_NONE, then the download
+  // file should be blocked.

[asanka, 2017/06/06 03:00:36]

Not accurate since it'll only be blocked if the interrupt reason is
FILE_BLOCKED. Other reasons may cause unintended behavior like resuming the
download automatically.

[MAD, 2017/06/06 18:00:28]

Acknowledged.

+  virtual void OnContentCheckCompleted(DownloadDangerType danger_type,
+                                       DownloadInterruptReason reason) = 0;
 
   // Mark the download to be auto-opened when completed.
   virtual void SetOpenWhenComplete(bool open) = 0;
 
   // Mark the download as having been opened (without actually opening it).
   virtual void SetOpened(bool opened) = 0;
 
   // Updates the last access time of the download.
   virtual void SetLastAccessTime(base::Time last_access_time) = 0;
 
   // Set a display name for the download that will be independent of the target
   // filename. If |name| is not empty, then GetFileNameToReportUser() will
   // return |name|. Has no effect on the final target filename.
   virtual void SetDisplayName(const base::FilePath& name) = 0;
 
   // Debug/testing -------------------------------------------------------------
   virtual std::string DebugString(bool verbose) const = 0;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_DOWNLOAD_ITEM_H_