[sql] Allow restricting database to user read access.

chrome/browser/password_manager/login_database_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "testing/gtest/include/gtest/gtest.h"
 
 #include "base/basictypes.h"
+#include "base/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "chrome/browser/password_manager/login_database.h"
 #include "chrome/common/chrome_paths.h"
 #include "content/public/common/password_form.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
@@ skipping 542 matching lines @@
 
   // Normal data.
   vec.push_back(ASCIIToUTF16("first"));
   vec.push_back(ASCIIToUTF16("second"));
   vec.push_back(ASCIIToUTF16("third"));
 
   temp = SerializeVector(vec);
   output = DeserializeVector(temp);
   EXPECT_THAT(output, Eq(vec));
 }
+
+#if defined(OS_POSIX)
+// Only the current user has permission to read the database.
+//
+// Only POSIX because GetPosixFilePermissions() only exists on POSIX.
+// This tests that sql::Connection::set_restrict_to_user() was called,
+// and that function is a noop on non-POSIX platforms in any case.
+TEST_F(LoginDatabaseTest, FilePermissions) {
+  int mode = file_util::FILE_PERMISSION_MASK;
+  EXPECT_TRUE(file_util::GetPosixFilePermissions(file_, &mode));
+  EXPECT_EQ((mode & file_util::FILE_PERMISSION_USER_MASK), mode);
+}
+#endif  // defined(OS_POSIX)