PS - Remove Clipboard Read permission from extensions in Public Sessions (except for whitelisted on…

chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc

Index: chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc
diff --git a/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc b/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc
new file mode 100644
index 0000000000000000000000000000000000000000..c2f84b8bafc814cae6b8f5c0b4a0ab2b6d27c4d5
--- /dev/null
+++ b/chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.cc
@@ -0,0 +1,38 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/extensions/permissions_updater_delegate_chromeos.h"
+
+#include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+#include "chrome/browser/profiles/profiles_state.h"
+#include "extensions/common/permissions/api_permission.h"
+#include "extensions/common/permissions/api_permission_set.h"
+#include "extensions/common/permissions/manifest_permission_set.h"
+#include "extensions/common/permissions/permission_set.h"
+#include "extensions/common/url_pattern_set.h"
+
+namespace extensions {
+
+PermissionsUpdaterDelegateChromeOS::PermissionsUpdaterDelegateChromeOS() {}
+
+PermissionsUpdaterDelegateChromeOS::~PermissionsUpdaterDelegateChromeOS() {}
+
+void PermissionsUpdaterDelegateChromeOS::InitializePermissions(
+    const Extension* extension,
+    std::unique_ptr<const PermissionSet>* granted_permissions) {
+  if (!profiles::IsPublicSession() ||
+      chromeos::DeviceLocalAccountManagementPolicyProvider::IsWhitelisted(
+          extension)) {

[Devlin, 2017/04/08 00:30:51]

nit: || !granted_permissions->HasAPIPermission(APIPermission::kClipboardRead)

[Ivan Šandrk, 2017/04/10 12:04:35]

Done.

+    return;
+  }
+  // Revoke kClipboardRead permission (used in Public Sessions to secure
+  // clipboard read functionality).
+  APIPermissionSet api_permission_set((*granted_permissions)->apis());
+  api_permission_set.erase(APIPermission::kClipboardRead);
+  granted_permissions->reset(
+      new PermissionSet(api_permission_set, ManifestPermissionSet(),
+                        URLPatternSet(), URLPatternSet()));
+}
+
+}  // namespace extensions