Enable system NSS key slot.

net/cert/nss_cert_database_chromeos.cc

Index: net/cert/nss_cert_database_chromeos.cc
diff --git a/net/cert/nss_cert_database_chromeos.cc b/net/cert/nss_cert_database_chromeos.cc
index 60f7f2ee64a8b4cdc49f9e2ada25d1996dbbc1d6..63d969cd7ea291ae2f152c189f4cb971f575721f 100644
--- a/net/cert/nss_cert_database_chromeos.cc
+++ b/net/cert/nss_cert_database_chromeos.cc
@@ -22,11 +22,21 @@ NSSCertDatabaseChromeOS::NSSCertDatabaseChromeOS(
     crypto::ScopedPK11Slot public_slot,
     crypto::ScopedPK11Slot private_slot)
     : NSSCertDatabase(public_slot.Pass(), private_slot.Pass()) {
-  profile_filter_.Init(GetPublicSlot(), GetPrivateSlot());
+  // By default, don't use a system slot. Only if explicitly set by
+  // SetSystemSlot, the system slot will be used.
+  profile_filter_.Init(GetPublicSlot(),
+                       GetPrivateSlot(),
+                       crypto::ScopedPK11Slot() /* no system slot */);
 }
 
 NSSCertDatabaseChromeOS::~NSSCertDatabaseChromeOS() {}
 
+void NSSCertDatabaseChromeOS::SetSystemSlot(
+    crypto::ScopedPK11Slot system_slot) {
+  system_slot_ = system_slot.Pass();
+  profile_filter_.Init(GetPublicSlot(), GetPrivateSlot(), GetSystemSlot());
+}
+
 void NSSCertDatabaseChromeOS::ListCertsSync(CertificateList* certs) {
   ListCertsImpl(profile_filter_, certs);
 }
@@ -45,6 +55,12 @@ void NSSCertDatabaseChromeOS::ListCerts(
       base::Bind(callback, base::Passed(&certs)));
 }
 
+crypto::ScopedPK11Slot NSSCertDatabaseChromeOS::GetSystemSlot() const {
+  if (system_slot_)
+    return crypto::ScopedPK11Slot(PK11_ReferenceSlot(system_slot_.get()));
+  return crypto::ScopedPK11Slot();
+}
+
 void NSSCertDatabaseChromeOS::ListModules(CryptoModuleList* modules,
                                           bool need_rw) const {
   NSSCertDatabase::ListModules(modules, need_rw);