Enable system NSS key slot.

net/cert/nss_cert_database_chromeos.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_NSS_CERT_DATABASE_CHROMEOS_
 #define NET_CERT_NSS_CERT_DATABASE_CHROMEOS_
 
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/base/net_export.h"
 #include "net/cert/nss_cert_database.h"
 #include "net/cert/nss_profile_filter_chromeos.h"
 
 namespace net {
 
 class NET_EXPORT NSSCertDatabaseChromeOS : public NSSCertDatabase {
  public:
+  // |public_slot| is the NSS software slot for the user.

[Ryan Sleevi, 2014/07/29 23:53:15]

Comment wise, I think the older bits were more correct.

In particular, there should be no assumption that |public_slot| is a software
slot. In the future, it will be a Chaps slot just the same.

It's just the place to store the public details.

[pneubeck (no reviews), 2014/07/30 06:27:39]

Actually, this comment should be unnecessary as the arguments are forwarded to
NSSCertDatabase?
With 'older bits' you probably mean the c'tor comment on NSSCertDatabase.

[Ryan Sleevi, 2014/07/30 06:45:30]

Yeah.

Either way, the comment is wrong as is. We shouldn't assume software.

[pneubeck (no reviews), 2014/07/30 13:54:10]

Removed.

+  // |private_slot| is the TPM slot for the user (if a TPM is present).
   NSSCertDatabaseChromeOS(crypto::ScopedPK11Slot public_slot,
                           crypto::ScopedPK11Slot private_slot);
   virtual ~NSSCertDatabaseChromeOS();
 
+  // |system_slot| is the system TPM slot, which is only enabled for certain
+  // users.
+  void SetSystemSlot(crypto::ScopedPK11Slot system_slot);
+
   // NSSCertDatabase implementation.
   virtual void ListCertsSync(CertificateList* certs) OVERRIDE;
   virtual void ListCerts(const NSSCertDatabase::ListCertsCallback& callback)
       OVERRIDE;
   virtual void ListModules(CryptoModuleList* modules, bool need_rw) const
       OVERRIDE;
+  virtual crypto::ScopedPK11Slot GetSystemSlot() const OVERRIDE;
 
   // TODO(mattm): handle trust setting, deletion, etc correctly when certs exist
   // in multiple slots.
   // TODO(mattm): handle trust setting correctly for certs in read-only slots.
 
  private:
   // Certificate listing implementation used by |ListCerts| and |ListCertsSync|.
   // The certificate list normally returned by NSSCertDatabase::ListCertsImpl
   // is additionally filtered by |profile_filter|.
   // Static so it may safely be used on the worker thread.
   static void ListCertsImpl(const NSSProfileFilterChromeOS& profile_filter,
                             CertificateList* certs);
 
   NSSProfileFilterChromeOS profile_filter_;
+  crypto::ScopedPK11Slot system_slot_;
 
   DISALLOW_COPY_AND_ASSIGN(NSSCertDatabaseChromeOS);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_NSS_CERT_DATABASE_CHROMEOS_