PS - Showing permission prompt for activeTab

chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
 
 #include <stddef.h>
 
 #include <cstddef>
 #include <string>
@@ skipping 371 matching lines @@
     // but it seems this does more harm than good as it would likely prevent the
     // extension from enabling assistive features. If the concerns prevail, we
     // should probably not block, but adjust the API to pretend accessibility is
     // off, so we don't punish apps that try to be helpful.
     "accessibilityFeatures.read",
 
     // Allows access to web contents in response to user gesture. Note that this
     // doesn't trigger a permission warning on install though, so blocking is
     // somewhat at odds with the spirit of the API - however I presume the API
     // design assumes user-installed extensions, which we don't have here.
-    // "activeTab",
+    // Whitelisted because it's restricted now (asks user for permission the
+    // first time an extension tries to use it).
+    "activeTab",
 
     // Schedule code to run at future times.
     "alarms",
 
     // PS UX can always be seen, this one doesn't go over it so it's fine.
     "app.window.alwaysOnTop",
 
     // Fullscreen is crippled in Public Sessions, maximizes instead, so both
     // fullscreen and overrideEsc are safe for use in PS. (The recommended
     // permission names are "app.window.*" but their unprefixed counterparts are
@@ skipping 542 matching lines @@
   if (error) {
     *error = l10n_util::GetStringFUTF16(
           IDS_EXTENSION_CANT_INSTALL_IN_DEVICE_LOCAL_ACCOUNT,
           base::UTF8ToUTF16(extension->name()),
           base::UTF8ToUTF16(extension->id()));
   }
   return false;
 }
 
 }  // namespace chromeos