Setup permissions for terminalPrivateApi.

Setup permissions for terminalPrivateApi.

Access to terminalPrivateApi will be allowed to component and hterm extensions only. Hterm extension is not component extension, so restricting access to component extensions only won't work. (Hterm already has access to webSocketPrivate API, and extension ID are copied from there)

Also, add "exit" to allowed process output event types (this event will be dispatched
when we detect a observed process has died).

BUG=chromium-os:23273
TEST=ExtensionTerminalPrivateApiTest.*

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=118967

[tbarzic, 2012-01-20 18:24:45]

Hi Aaron,
Can you take a look at this?

Toni

[Mihai Parparita -not on Chrome, 2012-01-21 00:11:17]

https://chromiumcodereview.appspot.com/9150051/diff/10/chrome/test/data/exten...
File chrome/test/data/extensions/api_test/terminal/no_permission/manifest.json
(right):

https://chromiumcodereview.appspot.com/9150051/diff/10/chrome/test/data/exten...
chrome/test/data/extensions/api_test/terminal/no_permission/manifest.json:6:
"page": "background.html"
This can be "scripts": ["background.js"] so that you don't need the
background.html anymore (see
http://code.google.com/chrome/extensions/trunk/background_pages.html)

[tbarzic, 2012-01-21 00:23:35]

https://chromiumcodereview.appspot.com/9150051/diff/10/chrome/test/data/exten...
File chrome/test/data/extensions/api_test/terminal/no_permission/manifest.json
(right):

https://chromiumcodereview.appspot.com/9150051/diff/10/chrome/test/data/exten...
chrome/test/data/extensions/api_test/terminal/no_permission/manifest.json:6:
"page": "background.html"
On 2012/01/21 00:11:17, Mihai Parparita wrote:
> This can be "scripts": ["background.js"] so that you don't need the
> background.html anymore (see
> http://code.google.com/chrome/extensions/trunk/background_pages.html)

Done.

[Aaron Boodman, 2012-01-24 18:46:36]

+jstritar

We need to formalize the concept of
api-only-available-to-whitelist-of-extensions and put it in
ExtensionPermissionSet or something. All these adhoc implementations are making
me really nervous.

Jon, do you have any ideas about how this could work? Is it something we could
easily add to ExtensionAPIPermission?

http://codereview.chromium.org/9150051/diff/11001/chrome/browser/extensions/a...
File chrome/browser/extensions/api/terminal/terminal_private_api.cc (right):

http://codereview.chromium.org/9150051/diff/11001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:185: if
(!AllowAccessToExtension(profile_, extension_id())) {
It seems like all of these functions should derive from a base class that does
this check. You can define a RunTerminalFunction() or something where you do
your actual work that RunImpl() calls.

[tbarzic, 2012-01-24 19:03:24]

http://codereview.chromium.org/9150051/diff/11001/chrome/browser/extensions/a...
File chrome/browser/extensions/api/terminal/terminal_private_api.cc (right):

http://codereview.chromium.org/9150051/diff/11001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:185: if
(!AllowAccessToExtension(profile_, extension_id())) {
On 2012/01/24 18:46:36, Aaron Boodman wrote:
> It seems like all of these functions should derive from a base class that does
> this check. You can define a RunTerminalFunction() or something where you do
> your actual work that RunImpl() calls.

Done.

[Aaron Boodman, 2012-01-24 19:29:13]

I think we should figure out the proper way to do these kinds of whitelisted
permissions. It does not seem hard to extend ExtensionPermissionSet to make each
permission also have a list of whitelisted extension IDs it is valid for, and
then check this in Extension::ParsePermissions() where we check other permission
conditions.

Can you look into this? Jon, can you help flesh out this proposal?

[jstritar, 2012-01-24 20:06:26]

Yeah, it seems like most permissions require more whitelisting than just
component / not component. I agree this should be straight forward to add to the
permissions code. I can take care of it.

[jstritar, 2012-01-24 21:39:56]

I'll handle centralizing the permission whitelists in a follow up CL. Here are
some comments on the rest of the CL

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
File chrome/browser/extensions/api/terminal/terminal_private_api.cc (right):

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:78: return;
How about converting this to a CHECK since TerminalPrivateFunction::RunImpl
should prevent it?

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:88: //
TODO(tbarzic): Send event only to the renderer that runs process pid.
I think you can remove this TODO since the ExtensionEventRouter already does
this.

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:91: extension_id,
"terminalPrivate.onProcessOutput", args_json,
We have a bunch of events declared as constants in
chrome/browser/extension_event_names.h. They don't all appear to be there, but
it might be a good place to put this.

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
File chrome/browser/extensions/api/terminal/terminal_private_api.h (right):

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.h:23: virtual bool
RunTerminalFunction() = 0;
nit: you can probably make RunImpl private and RunTerminalFunction protected.

[Aaron Boodman, 2012-01-24 21:42:40]

LGTM once Jon is happy.

- a

On Tue, Jan 24, 2012 at 11:29 AM,  <[email protected]> wrote:
> I think we should figure out the proper way to do these kinds of whitelisted
> permissions. It does not seem hard to extend ExtensionPermissionSet to make
> each
> permission also have a list of whitelisted extension IDs it is valid for,
> and
> then check this in Extension::ParsePermissions() where we check other
> permission
> conditions.
>
> Can you look into this? Jon, can you help flesh out this proposal?
>
> http://codereview.chromium.org/9150051/

[tbarzic, 2012-01-24 22:04:48]

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
File chrome/browser/extensions/api/terminal/terminal_private_api.cc (right):

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:78: return;
On 2012/01/24 21:39:56, jstritar wrote:
> How about converting this to a CHECK since TerminalPrivateFunction::RunImpl
> should prevent it?

Done.

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:88: //
TODO(tbarzic): Send event only to the renderer that runs process pid.
On 2012/01/24 21:39:56, jstritar wrote:
> I think you can remove this TODO since the ExtensionEventRouter already does
> this.

Done.

http://codereview.chromium.org/9150051/diff/20001/chrome/browser/extensions/a...
chrome/browser/extensions/api/terminal/terminal_private_api.cc:91: extension_id,
"terminalPrivate.onProcessOutput", args_json,
On 2012/01/24 21:39:56, jstritar wrote:
> We have a bunch of events declared as constants in
> chrome/browser/extension_event_names.h. They don't all appear to be there, but
> it might be a good place to put this.

Yeah, I planned to do that in next iteration, but I guess I can do it now..

[jstritar, 2012-01-24 22:07:19]

LGTM