PS - Remove Clipboard Read permission from extensions in Public Sessions (except for whitelisted on…

chrome/browser/extensions/permissions_updater.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/permissions_updater.h"
 
 #include <utility>
 
 #include "base/memory/ref_counted.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/api/permissions/permissions_api_helpers.h"
 #include "chrome/browser/extensions/scripting_permissions_modifier.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profiles_state.h"
 #include "chrome/common/extensions/api/permissions.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_process_host.h"
 #include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/notification_types.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/manifest_handlers/permissions_parser.h"
 #include "extensions/common/permissions/permission_set.h"
 #include "extensions/common/permissions/permissions_data.h"
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+#endif
+
 using content::RenderProcessHost;
 using extensions::permissions_api_helpers::PackPermissionSet;
 
 namespace extensions {
 
 namespace permissions = api::permissions;
 
 namespace {
 
 // Returns a PermissionSet that has the active permissions of the extension,
@@ skipping 154 matching lines @@
 
   std::unique_ptr<const PermissionSet> granted_permissions;
   std::unique_ptr<const PermissionSet> withheld_permissions;
   ScriptingPermissionsModifier(browser_context_, make_scoped_refptr(extension))
       .WithholdPermissions(*bounded_active, &granted_permissions,
                            &withheld_permissions,
                            (init_flag_ & INIT_FLAG_TRANSIENT) != 0);
 
   SetPermissions(extension, std::move(granted_permissions),
                  std::move(withheld_permissions));
+
+#if defined(OS_CHROMEOS)

[Devlin, 2017/04/03 20:39:20]

I'd like to avoid adding so many #ifdefs and chromeos + public sessions specific
logic here.  Could we instead do something like:

namespace {

PermissionsUpdater* g_delegate = nullptr;

}

void PermissionsUpdater::SetPlatformDelegate(Delegate* delegate) {
  g_delegate = delegate;
}

void InitializePermissions() {
  ....

  if (g_delegate)
    g_delegate->InitializePermissions(...);
}

and then in CrOS-specific code, have a PermissionsUpdaterDelegate that
implements an InitializePermissions function that withholds this?

It's a bit more code, but I think it's a little cleaner in the sense that it
keeps core extensions code from needing to know (more) about public sessions,
etc.

+  // In Public Sessions, apps and extensions are force-installed by admin policy
+  // so the user does not get a chance to review the permissions for these apps.
+  // This is not acceptable from a security standpoint, so we remove
+  // ClipboardRead permission from them (except for whitelisted ones - eg.
+  // remote desktop clients). This forceful removal of permission is safe since
+  // the clipboard pasting code checks for this permission before doing the
+  // paste.
+  if (profiles::IsPublicSession() &&
+      !chromeos::DeviceLocalAccountManagementPolicyProvider::IsWhitelisted(
+          extension)) {
+    ScriptingPermissionsModifier(browser_context_,
+                                 make_scoped_refptr(extension))
+        .WithholdClipboardRead();
+  }
+#endif
 }
 
 void PermissionsUpdater::SetPermissions(
     const Extension* extension,
     std::unique_ptr<const PermissionSet> active,
     std::unique_ptr<const PermissionSet> withheld) {
   DCHECK(active);
   const PermissionSet& active_weak = *active;
   if (withheld) {
     extension->permissions_data()->SetPermissions(std::move(active),
@@ skipping 74 matching lines @@
             Profile::FromBrowserContext(host->GetBrowserContext()))) {
       host->Send(new ExtensionMsg_UpdatePermissions(params));
     }
   }
 
   // Trigger the onAdded and onRemoved events in the extension.
   DispatchEvent(extension->id(), histogram_value, event_name, changed);
 }
 
 }  // namespace extensions