Put app shim IPC socket in a temporary directory. (Mac)

chrome/common/mac/app_mode_common.mm

Index: chrome/common/mac/app_mode_common.mm
diff --git a/chrome/common/mac/app_mode_common.mm b/chrome/common/mac/app_mode_common.mm
index 317dec3b6331e32aa8ae332f02d4c4d9b74708f8..ad8223c79740bfec4f055fc930cdfa14a59ddf89 100644
--- a/chrome/common/mac/app_mode_common.mm
+++ b/chrome/common/mac/app_mode_common.mm
@@ -4,6 +4,8 @@
 
 #include "chrome/common/mac/app_mode_common.h"
 
+#include "base/file_util.h"
+
 namespace app_mode {
 
 const char kAppShimSocketName[] = "App Shim Socket";
@@ -40,4 +42,19 @@ ChromeAppModeInfo::ChromeAppModeInfo()
 ChromeAppModeInfo::~ChromeAppModeInfo() {
 }
 
+void VerifySocketPermissions(const base::FilePath& socket_path) {
+  CHECK(base::PathIsWritable(socket_path));
+  int socket_mode = 0;
+  CHECK(base::GetPosixFilePermissions(socket_path, &socket_mode));
+  int socket_permissions =
+      base::FILE_PERMISSION_MASK &
+      ~(base::FILE_PERMISSION_WRITE_BY_GROUP) &
+      ~(base::FILE_PERMISSION_WRITE_BY_OTHERS);

[tapted, 2014/01/03 13:06:54]

ugh - why does this enum exist.. The comment says "Bits ans [sic] masks of the
file permission". I'd find CHECK_EQ(0755, socket_mode) a lot more readable -
maybe I'm just old school :p. But also, are we sure this is guaranteed? If you
run `umask 0007` from Terminal, then run Chrome with the full path to the binary
in the app bundle, will it fail? -- inheriting that umask might make the mode
0750 instead.

[jackhou1, 2014/01/06 05:29:52]

Done.

Also you're right, the sockets permissions depend on umask. However, the
directory is always created with 0700. Would we need to set the mode of the
socket explicitly?

[tapted, 2014/01/06 07:31:28]

I don't think we need to set the socket inode permissions separately (parent
folder in mode 0700 should be sufficient), but the security folks will know
better.

+  CHECK_EQ(socket_permissions, socket_mode);
+  base::FilePath socket_dir = socket_path.DirName();
+  int socket_dir_mode = 0;
+  CHECK(base::GetPosixFilePermissions(socket_dir, &socket_dir_mode));
+  CHECK_EQ(base::FILE_PERMISSION_USER_MASK, socket_dir_mode);
+}
+
 }  // namespace app_mode