Adding a DownloadRestrictions group policy.

content/public/browser/download_item.h

Index: content/public/browser/download_item.h
diff --git a/content/public/browser/download_item.h b/content/public/browser/download_item.h
index 9b6d933c3c485261eb7146a72f279259b78a1b0f..c5fa6df29fab5a67d6ad4d27a90407e599e7f709 100644
--- a/content/public/browser/download_item.h
+++ b/content/public/browser/download_item.h
@@ -78,10 +78,10 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
 
   // How the final target path should be used.
   enum TargetDisposition {
-    TARGET_DISPOSITION_OVERWRITE, // Overwrite if the target already exists.
-    TARGET_DISPOSITION_PROMPT     // Prompt the user for the actual
-                                  // target. Implies
-                                  // TARGET_DISPOSITION_OVERWRITE.
+    TARGET_DISPOSITION_OVERWRITE,  // Overwrite if the target already exists.
+    TARGET_DISPOSITION_PROMPT      // Prompt the user for the actual
+                                   // target. Implies
+                                   // TARGET_DISPOSITION_OVERWRITE.
   };
 
   // Callback used with AcquireFileAndDeleteDownload().
@@ -435,8 +435,10 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
 
   // Called if a check of the download contents was performed and the results of
   // the test are available. This should only be called after AllDataSaved() is
-  // true.
-  virtual void OnContentCheckCompleted(DownloadDangerType danger_type) = 0;
+  // true. If |reason| is not DOWNLOAD_INTERRUPT_REASON_NONE, then the download
+  // file should be blocked.

[asanka, 2017/06/06 03:00:36]

Not accurate since it'll only be blocked if the interrupt reason is
FILE_BLOCKED. Other reasons may cause unintended behavior like resuming the
download automatically.

[MAD, 2017/06/06 18:00:28]

Acknowledged.

+  virtual void OnContentCheckCompleted(DownloadDangerType danger_type,
+                                       DownloadInterruptReason reason) = 0;
 
   // Mark the download to be auto-opened when completed.
   virtual void SetOpenWhenComplete(bool open) = 0;