content/browser/child_process_security_policy_impl.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/child_process_security_policy_impl.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/files/file_path.h"
   9 #include "base/logging.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/stl_util.h"
  12 #include "base/strings/string_util.h"
  13 #include "content/browser/plugin_process_host.h"
  14 #include "content/browser/site_instance_impl.h"
  15 #include "content/common/site_isolation_policy.h"
  16 #include "content/public/browser/child_process_data.h"
  17 #include "content/public/browser/content_browser_client.h"
  18 #include "content/public/browser/render_process_host.h"
  19 #include "content/public/common/bindings_policy.h"
  20 #include "content/public/common/url_constants.h"
  21 #include "net/base/filename_util.h"
  22 #include "net/url_request/url_request.h"
  23 #include "storage/browser/fileapi/file_permission_policy.h"
  24 #include "storage/browser/fileapi/file_system_url.h"
  25 #include "storage/browser/fileapi/isolated_context.h"
  26 #include "storage/common/fileapi/file_system_util.h"
  27 #include "url/gurl.h"
  28
  29 namespace content {
  30
  31 namespace {
  32
  33 // Used internally only. These bit positions have no relationship to any
  34 // underlying OS and can be changed to accommodate finer-grained permissions.
  35 enum ChildProcessSecurityPermissions {
  36   READ_FILE_PERMISSION             = 1 << 0,
  37   WRITE_FILE_PERMISSION            = 1 << 1,
  38   CREATE_NEW_FILE_PERMISSION       = 1 << 2,
  39   CREATE_OVERWRITE_FILE_PERMISSION = 1 << 3,
  40   DELETE_FILE_PERMISSION           = 1 << 4,
  41
  42   // Used by Media Galleries API
  43   COPY_INTO_FILE_PERMISSION        = 1 << 5,
  44 };
  45
  46 // Used internally only. Bitmasks that are actually used by the Grant* and Can*
  47 // methods. These contain one or more ChildProcessSecurityPermissions.
  48 enum ChildProcessSecurityGrants {
  49   READ_FILE_GRANT              = READ_FILE_PERMISSION,
  50   WRITE_FILE_GRANT             = WRITE_FILE_PERMISSION,
  51
  52   CREATE_NEW_FILE_GRANT        = CREATE_NEW_FILE_PERMISSION |
  53                                  COPY_INTO_FILE_PERMISSION,
  54
  55   CREATE_READ_WRITE_FILE_GRANT = CREATE_NEW_FILE_PERMISSION |
  56                                  CREATE_OVERWRITE_FILE_PERMISSION |
  57                                  READ_FILE_PERMISSION |
  58                                  WRITE_FILE_PERMISSION |
  59                                  COPY_INTO_FILE_PERMISSION |
  60                                  DELETE_FILE_PERMISSION,
  61
  62   COPY_INTO_FILE_GRANT         = COPY_INTO_FILE_PERMISSION,
  63   DELETE_FILE_GRANT            = DELETE_FILE_PERMISSION,
  64 };
  65
  66 }  // namespace
  67
  68 // The SecurityState class is used to maintain per-child process security state
  69 // information.
  70 class ChildProcessSecurityPolicyImpl::SecurityState {
  71  public:
  72   SecurityState()
  73     : enabled_bindings_(0),
  74       can_read_raw_cookies_(false),
  75       can_send_midi_sysex_(false) { }
  76
  77   ~SecurityState() {
  78     scheme_policy_.clear();
  79     storage::IsolatedContext* isolated_context =
  80         storage::IsolatedContext::GetInstance();
  81     for (FileSystemMap::iterator iter = filesystem_permissions_.begin();
  82          iter != filesystem_permissions_.end();
  83          ++iter) {
  84       isolated_context->RemoveReference(iter->first);
  85     }
  86     UMA_HISTOGRAM_COUNTS("ChildProcessSecurityPolicy.PerChildFilePermissions",
  87                          file_permissions_.size());
  88   }
  89
  90   // Grant permission to request URLs with the specified scheme.
  91   void GrantScheme(const std::string& scheme) {
  92     scheme_policy_[scheme] = true;
  93   }
  94
  95   // Revoke permission to request URLs with the specified scheme.
  96   void RevokeScheme(const std::string& scheme) {
  97     scheme_policy_[scheme] = false;
  98   }
  99
 100   // Grant certain permissions to a file.
 101   void GrantPermissionsForFile(const base::FilePath& file, int permissions) {
 102     base::FilePath stripped = file.StripTrailingSeparators();
 103     file_permissions_[stripped] |= permissions;
 104     UMA_HISTOGRAM_COUNTS("ChildProcessSecurityPolicy.FilePermissionPathLength",
 105                          stripped.value().size());
 106   }
 107
 108   // Grant navigation to a file but not the file:// scheme in general.
 109   void GrantRequestOfSpecificFile(const base::FilePath &file) {
 110     request_file_set_.insert(file.StripTrailingSeparators());
 111   }
 112
 113   // Revokes all permissions granted to a file.
 114   void RevokeAllPermissionsForFile(const base::FilePath& file) {
 115     base::FilePath stripped = file.StripTrailingSeparators();
 116     file_permissions_.erase(stripped);
 117     request_file_set_.erase(stripped);
 118   }
 119
 120   // Grant certain permissions to a file.
 121   void GrantPermissionsForFileSystem(const std::string& filesystem_id,
 122                                      int permissions) {
 123     if (!ContainsKey(filesystem_permissions_, filesystem_id))
 124       storage::IsolatedContext::GetInstance()->AddReference(filesystem_id);
 125     filesystem_permissions_[filesystem_id] |= permissions;
 126   }
 127
 128   bool HasPermissionsForFileSystem(const std::string& filesystem_id,
 129                                    int permissions) {
 130     FileSystemMap::const_iterator it =
 131         filesystem_permissions_.find(filesystem_id);
 132     if (it == filesystem_permissions_.end())
 133       return false;
 134     return (it->second & permissions) == permissions;
 135   }
 136
 137 #if defined(OS_ANDROID)
 138   // Determine if the certain permissions have been granted to a content URI.
 139   bool HasPermissionsForContentUri(const base::FilePath& file,
 140                                    int permissions) {
 141     DCHECK(!file.empty());
 142     DCHECK(file.IsContentUri());
 143     if (!permissions)
 144       return false;
 145     base::FilePath file_path = file.StripTrailingSeparators();
 146     FileMap::const_iterator it = file_permissions_.find(file_path);
 147     if (it != file_permissions_.end())
 148       return (it->second & permissions) == permissions;
 149     return false;
 150   }
 151 #endif
 152
 153   void GrantBindings(int bindings) {
 154     enabled_bindings_ |= bindings;
 155   }
 156
 157   void GrantReadRawCookies() {
 158     can_read_raw_cookies_ = true;
 159   }
 160
 161   void RevokeReadRawCookies() {
 162     can_read_raw_cookies_ = false;
 163   }
 164
 165   void GrantPermissionForMidiSysEx() {
 166     can_send_midi_sysex_ = true;
 167   }
 168
 169   // Determine whether permission has been granted to commit |url|.
 170   bool CanCommitURL(const GURL& url) {
 171     // Having permission to a scheme implies permssion to all of its URLs.
 172     SchemeMap::const_iterator judgment(scheme_policy_.find(url.scheme()));
 173     if (judgment != scheme_policy_.end())
 174       return judgment->second;
 175
 176     // file:// URLs are more granular.  The child may have been given
 177     // permission to a specific file but not the file:// scheme in general.
 178     if (url.SchemeIs(url::kFileScheme)) {
 179       base::FilePath path;
 180       if (net::FileURLToFilePath(url, &path))
 181         return ContainsKey(request_file_set_, path);
 182     }
 183
 184     return false;  // Unmentioned schemes are disallowed.
 185   }
 186
 187   // Determine if the certain permissions have been granted to a file.
 188   bool HasPermissionsForFile(const base::FilePath& file, int permissions) {
 189 #if defined(OS_ANDROID)
 190     if (file.IsContentUri())
 191       return HasPermissionsForContentUri(file, permissions);
 192 #endif
 193     if (!permissions || file.empty() || !file.IsAbsolute())
 194       return false;
 195     base::FilePath current_path = file.StripTrailingSeparators();
 196     base::FilePath last_path;
 197     int skip = 0;
 198     while (current_path != last_path) {
 199       base::FilePath base_name = current_path.BaseName();
 200       if (base_name.value() == base::FilePath::kParentDirectory) {
 201         ++skip;
 202       } else if (skip > 0) {
 203         if (base_name.value() != base::FilePath::kCurrentDirectory)
 204           --skip;
 205       } else {
 206         FileMap::const_iterator it = file_permissions_.find(current_path);
 207         if (it != file_permissions_.end())
 208           return (it->second & permissions) == permissions;
 209       }
 210       last_path = current_path;
 211       current_path = current_path.DirName();
 212     }
 213
 214     return false;
 215   }
 216
 217   bool CanAccessDataForOrigin(const GURL& gurl) {
 218     if (origin_lock_.is_empty())
 219       return true;
 220     // TODO(creis): We must pass the valid browser_context to convert hosted
 221     // apps URLs.  Currently, hosted apps cannot set cookies in this mode.
 222     // See http://crbug.com/160576.
 223     GURL site_gurl = SiteInstanceImpl::GetSiteForURL(NULL, gurl);
 224     return origin_lock_ == site_gurl;
 225   }
 226
 227   void LockToOrigin(const GURL& gurl) {
 228     origin_lock_ = gurl;
 229   }
 230
 231   bool has_web_ui_bindings() const {
 232     return enabled_bindings_ & BINDINGS_POLICY_WEB_UI;
 233   }
 234
 235   bool can_read_raw_cookies() const {
 236     return can_read_raw_cookies_;
 237   }
 238
 239   bool can_send_midi_sysex() const {
 240     return can_send_midi_sysex_;
 241   }
 242
 243  private:
 244   typedef std::map<std::string, bool> SchemeMap;
 245
 246   typedef int FilePermissionFlags;  // bit-set of base::File::Flags
 247   typedef std::map<base::FilePath, FilePermissionFlags> FileMap;
 248   typedef std::map<std::string, FilePermissionFlags> FileSystemMap;
 249   typedef std::set<base::FilePath> FileSet;
 250
 251   // Maps URL schemes to whether permission has been granted or revoked:
 252   //   |true| means the scheme has been granted.
 253   //   |false| means the scheme has been revoked.
 254   // If a scheme is not present in the map, then it has never been granted
 255   // or revoked.
 256   SchemeMap scheme_policy_;
 257
 258   // The set of files the child process is permited to upload to the web.
 259   FileMap file_permissions_;
 260
 261   // The set of files the child process is permitted to load.
 262   FileSet request_file_set_;
 263
 264   int enabled_bindings_;
 265
 266   bool can_read_raw_cookies_;
 267
 268   bool can_send_midi_sysex_;
 269
 270   GURL origin_lock_;
 271
 272   // The set of isolated filesystems the child process is permitted to access.
 273   FileSystemMap filesystem_permissions_;
 274
 275   DISALLOW_COPY_AND_ASSIGN(SecurityState);
 276 };
 277
 278 ChildProcessSecurityPolicyImpl::ChildProcessSecurityPolicyImpl() {
 279   // We know about these schemes and believe them to be safe.
 280   RegisterWebSafeScheme(url::kHttpScheme);
 281   RegisterWebSafeScheme(url::kHttpsScheme);
 282   RegisterWebSafeScheme(url::kFtpScheme);
 283   RegisterWebSafeScheme(url::kDataScheme);
 284   RegisterWebSafeScheme("feed");
 285   RegisterWebSafeScheme(url::kBlobScheme);
 286   RegisterWebSafeScheme(url::kFileSystemScheme);
 287
 288   // We know about the following pseudo schemes and treat them specially.
 289   RegisterPseudoScheme(url::kAboutScheme);
 290   RegisterPseudoScheme(url::kJavaScriptScheme);
 291   RegisterPseudoScheme(kViewSourceScheme);
 292 }
 293
 294 ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() {
 295   web_safe_schemes_.clear();
 296   pseudo_schemes_.clear();
 297   STLDeleteContainerPairSecondPointers(security_state_.begin(),
 298                                        security_state_.end());
 299   security_state_.clear();
 300 }
 301
 302 // static
 303 ChildProcessSecurityPolicy* ChildProcessSecurityPolicy::GetInstance() {
 304   return ChildProcessSecurityPolicyImpl::GetInstance();
 305 }
 306
 307 ChildProcessSecurityPolicyImpl* ChildProcessSecurityPolicyImpl::GetInstance() {
 308   return base::Singleton<ChildProcessSecurityPolicyImpl>::get();
 309 }
 310
 311 void ChildProcessSecurityPolicyImpl::Add(int child_id) {
 312   base::AutoLock lock(lock_);
 313   AddChild(child_id);
 314 }
 315
 316 void ChildProcessSecurityPolicyImpl::AddWorker(int child_id,
 317                                                int main_render_process_id) {
 318   base::AutoLock lock(lock_);
 319   AddChild(child_id);
 320   worker_map_[child_id] = main_render_process_id;
 321 }
 322
 323 void ChildProcessSecurityPolicyImpl::Remove(int child_id) {
 324   base::AutoLock lock(lock_);
 325   SecurityStateMap::iterator it = security_state_.find(child_id);
 326   if (it == security_state_.end())
 327     return;  // May be called multiple times.
 328
 329   delete it->second;
 330   security_state_.erase(it);
 331   worker_map_.erase(child_id);
 332 }
 333
 334 void ChildProcessSecurityPolicyImpl::RegisterWebSafeScheme(
 335     const std::string& scheme) {
 336   base::AutoLock lock(lock_);
 337   DCHECK_EQ(0U, web_safe_schemes_.count(scheme)) << "Add schemes at most once.";
 338   DCHECK_EQ(0U, pseudo_schemes_.count(scheme))
 339       << "Web-safe implies not pseudo.";
 340
 341   web_safe_schemes_.insert(scheme);
 342 }
 343
 344 bool ChildProcessSecurityPolicyImpl::IsWebSafeScheme(
 345     const std::string& scheme) {
 346   base::AutoLock lock(lock_);
 347
 348   return ContainsKey(web_safe_schemes_, scheme);
 349 }
 350
 351 void ChildProcessSecurityPolicyImpl::RegisterPseudoScheme(
 352     const std::string& scheme) {
 353   base::AutoLock lock(lock_);
 354   DCHECK_EQ(0U, pseudo_schemes_.count(scheme)) << "Add schemes at most once.";
 355   DCHECK_EQ(0U, web_safe_schemes_.count(scheme))
 356       << "Pseudo implies not web-safe.";
 357
 358   pseudo_schemes_.insert(scheme);
 359 }
 360
 361 bool ChildProcessSecurityPolicyImpl::IsPseudoScheme(
 362     const std::string& scheme) {
 363   base::AutoLock lock(lock_);
 364
 365   return ContainsKey(pseudo_schemes_, scheme);
 366 }
 367
 368 void ChildProcessSecurityPolicyImpl::GrantRequestURL(
 369     int child_id, const GURL& url) {
 370
 371   if (!url.is_valid())
 372     return;  // Can't grant the capability to request invalid URLs.
 373
 374   if (IsWebSafeScheme(url.scheme()))
 375     return;  // The scheme has already been whitelisted for every child process.
 376
 377   if (IsPseudoScheme(url.scheme())) {
 378     // The view-source scheme is a special case of a pseudo-URL that eventually
 379     // results in requesting its embedded URL.
 380     if (url.SchemeIs(kViewSourceScheme)) {
 381       // URLs with the view-source scheme typically look like:
 382       //   view-source:http://www.google.com/a
 383       // In order to request these URLs, the child_id needs to be able to
 384       // request the embedded URL.
 385       GrantRequestURL(child_id, GURL(url.GetContent()));
 386     }
 387
 388     return;  // Can't grant the capability to request pseudo schemes.
 389   }
 390
 391   {
 392     base::AutoLock lock(lock_);
 393     SecurityStateMap::iterator state = security_state_.find(child_id);
 394     if (state == security_state_.end())
 395       return;
 396
 397     // When the child process has been commanded to request this scheme,
 398     // we grant it the capability to request all URLs of that scheme.
 399     state->second->GrantScheme(url.scheme());
 400   }
 401 }
 402
 403 void ChildProcessSecurityPolicyImpl::GrantRequestSpecificFileURL(
 404     int child_id,
 405     const GURL& url) {
 406   if (!url.SchemeIs(url::kFileScheme))
 407     return;
 408
 409   {
 410     base::AutoLock lock(lock_);
 411     SecurityStateMap::iterator state = security_state_.find(child_id);
 412     if (state == security_state_.end())
 413       return;
 414
 415     // When the child process has been commanded to request a file:// URL,
 416     // then we grant it the capability for that URL only.
 417     base::FilePath path;
 418     if (net::FileURLToFilePath(url, &path))
 419       state->second->GrantRequestOfSpecificFile(path);
 420   }
 421 }
 422
 423 void ChildProcessSecurityPolicyImpl::GrantReadFile(int child_id,
 424                                                    const base::FilePath& file) {
 425   GrantPermissionsForFile(child_id, file, READ_FILE_GRANT);
 426 }
 427
 428 void ChildProcessSecurityPolicyImpl::GrantCreateReadWriteFile(
 429     int child_id, const base::FilePath& file) {
 430   GrantPermissionsForFile(child_id, file, CREATE_READ_WRITE_FILE_GRANT);
 431 }
 432
 433 void ChildProcessSecurityPolicyImpl::GrantCopyInto(int child_id,
 434                                                    const base::FilePath& dir) {
 435   GrantPermissionsForFile(child_id, dir, COPY_INTO_FILE_GRANT);
 436 }
 437
 438 void ChildProcessSecurityPolicyImpl::GrantDeleteFrom(
 439     int child_id, const base::FilePath& dir) {
 440   GrantPermissionsForFile(child_id, dir, DELETE_FILE_GRANT);
 441 }
 442
 443 void ChildProcessSecurityPolicyImpl::GrantPermissionsForFile(
 444     int child_id, const base::FilePath& file, int permissions) {
 445   base::AutoLock lock(lock_);
 446
 447   SecurityStateMap::iterator state = security_state_.find(child_id);
 448   if (state == security_state_.end())
 449     return;
 450
 451   state->second->GrantPermissionsForFile(file, permissions);
 452 }
 453
 454 void ChildProcessSecurityPolicyImpl::RevokeAllPermissionsForFile(
 455     int child_id, const base::FilePath& file) {
 456   base::AutoLock lock(lock_);
 457
 458   SecurityStateMap::iterator state = security_state_.find(child_id);
 459   if (state == security_state_.end())
 460     return;
 461
 462   state->second->RevokeAllPermissionsForFile(file);
 463 }
 464
 465 void ChildProcessSecurityPolicyImpl::GrantReadFileSystem(
 466     int child_id, const std::string& filesystem_id) {
 467   GrantPermissionsForFileSystem(child_id, filesystem_id, READ_FILE_GRANT);
 468 }
 469
 470 void ChildProcessSecurityPolicyImpl::GrantWriteFileSystem(
 471     int child_id, const std::string& filesystem_id) {
 472   GrantPermissionsForFileSystem(child_id, filesystem_id, WRITE_FILE_GRANT);
 473 }
 474
 475 void ChildProcessSecurityPolicyImpl::GrantCreateFileForFileSystem(
 476     int child_id, const std::string& filesystem_id) {
 477   GrantPermissionsForFileSystem(child_id, filesystem_id, CREATE_NEW_FILE_GRANT);
 478 }
 479
 480 void ChildProcessSecurityPolicyImpl::GrantCreateReadWriteFileSystem(
 481     int child_id, const std::string& filesystem_id) {
 482   GrantPermissionsForFileSystem(
 483       child_id, filesystem_id, CREATE_READ_WRITE_FILE_GRANT);
 484 }
 485
 486 void ChildProcessSecurityPolicyImpl::GrantCopyIntoFileSystem(
 487     int child_id, const std::string& filesystem_id) {
 488   GrantPermissionsForFileSystem(child_id, filesystem_id, COPY_INTO_FILE_GRANT);
 489 }
 490
 491 void ChildProcessSecurityPolicyImpl::GrantDeleteFromFileSystem(
 492     int child_id, const std::string& filesystem_id) {
 493   GrantPermissionsForFileSystem(child_id, filesystem_id, DELETE_FILE_GRANT);
 494 }
 495
 496 void ChildProcessSecurityPolicyImpl::GrantSendMidiSysExMessage(int child_id) {
 497   base::AutoLock lock(lock_);
 498
 499   SecurityStateMap::iterator state = security_state_.find(child_id);
 500   if (state == security_state_.end())
 501     return;
 502
 503   state->second->GrantPermissionForMidiSysEx();
 504 }
 505
 506 void ChildProcessSecurityPolicyImpl::GrantScheme(int child_id,
 507                                                  const std::string& scheme) {
 508   base::AutoLock lock(lock_);
 509
 510   SecurityStateMap::iterator state = security_state_.find(child_id);
 511   if (state == security_state_.end())
 512     return;
 513
 514   state->second->GrantScheme(scheme);
 515 }
 516
 517 void ChildProcessSecurityPolicyImpl::GrantWebUIBindings(int child_id) {
 518   base::AutoLock lock(lock_);
 519
 520   SecurityStateMap::iterator state = security_state_.find(child_id);
 521   if (state == security_state_.end())
 522     return;
 523
 524   state->second->GrantBindings(BINDINGS_POLICY_WEB_UI);
 525
 526   // Web UI bindings need the ability to request chrome: URLs.
 527   state->second->GrantScheme(kChromeUIScheme);
 528
 529   // Web UI pages can contain links to file:// URLs.
 530   state->second->GrantScheme(url::kFileScheme);
 531 }
 532
 533 void ChildProcessSecurityPolicyImpl::GrantReadRawCookies(int child_id) {
 534   base::AutoLock lock(lock_);
 535
 536   SecurityStateMap::iterator state = security_state_.find(child_id);
 537   if (state == security_state_.end())
 538     return;
 539
 540   state->second->GrantReadRawCookies();
 541 }
 542
 543 void ChildProcessSecurityPolicyImpl::RevokeReadRawCookies(int child_id) {
 544   base::AutoLock lock(lock_);
 545
 546   SecurityStateMap::iterator state = security_state_.find(child_id);
 547   if (state == security_state_.end())
 548     return;
 549
 550   state->second->RevokeReadRawCookies();
 551 }
 552
 553 bool ChildProcessSecurityPolicyImpl::CanRequestURL(
 554     int child_id, const GURL& url) {
 555   if (!url.is_valid())
 556     return false;  // Can't request invalid URLs.
 557
 558   if (IsPseudoScheme(url.scheme())) {
 559     // There are a number of special cases for pseudo schemes.
 560
 561     if (url.SchemeIs(kViewSourceScheme)) {
 562       // A view-source URL is allowed if the child process is permitted to
 563       // request the embedded URL. Careful to avoid pointless recursion.
 564       GURL child_url(url.GetContent());
 565       if (child_url.SchemeIs(kViewSourceScheme) &&
 566           url.SchemeIs(kViewSourceScheme))
 567           return false;
 568
 569       return CanRequestURL(child_id, child_url);
 570     }
 571
 572     if (base::LowerCaseEqualsASCII(url.spec(), url::kAboutBlankURL))
 573       return true;  // Every child process can request <about:blank>.
 574
 575     // URLs like <about:memory> and <about:crash> shouldn't be requestable by
 576     // any child process.  Also, this case covers <javascript:...>, which should
 577     // be handled internally by the process and not kicked up to the browser.
 578     return false;
 579   }
 580
 581   // If the process can commit the URL, it can request it.
 582   if (CanCommitURL(child_id, url))
 583     return true;
 584
 585   // Also allow URLs destined for ShellExecute and not the browser itself.
 586   return !GetContentClient()->browser()->IsHandledURL(url) &&
 587          !net::URLRequest::IsHandledURL(url);
 588 }
 589
 590 bool ChildProcessSecurityPolicyImpl::CanCommitURL(int child_id,
 591                                                   const GURL& url) {
 592   if (!url.is_valid())
 593     return false;  // Can't commit invalid URLs.
 594
 595   // Of all the pseudo schemes, only about:blank is allowed to commit.
 596   if (IsPseudoScheme(url.scheme()))
 597     return base::LowerCaseEqualsASCII(url.spec(), url::kAboutBlankURL);
 598
 599   // TODO(creis): Tighten this for Site Isolation, so that a URL from a site
 600   // that is isolated can only be committed in a process dedicated to that site.
 601   // CanRequestURL should still allow all web-safe schemes. See
 602   // https://crbug.com/515309.
 603   if (IsWebSafeScheme(url.scheme()))
 604     return true;  // The scheme has been white-listed for every child process.
 605
 606   {
 607     base::AutoLock lock(lock_);
 608
 609     SecurityStateMap::iterator state = security_state_.find(child_id);
 610     if (state == security_state_.end())
 611       return false;
 612
 613     // Otherwise, we consult the child process's security state to see if it is
 614     // allowed to commit the URL.
 615     return state->second->CanCommitURL(url);
 616   }
 617 }
 618
 619 bool ChildProcessSecurityPolicyImpl::CanReadFile(int child_id,
 620                                                  const base::FilePath& file) {
 621   return HasPermissionsForFile(child_id, file, READ_FILE_GRANT);
 622 }
 623
 624 bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFile(
 625     int child_id,
 626     const base::FilePath& file) {
 627   return HasPermissionsForFile(child_id, file, CREATE_READ_WRITE_FILE_GRANT);
 628 }
 629
 630 bool ChildProcessSecurityPolicyImpl::CanReadFileSystem(
 631     int child_id, const std::string& filesystem_id) {
 632   return HasPermissionsForFileSystem(child_id, filesystem_id, READ_FILE_GRANT);
 633 }
 634
 635 bool ChildProcessSecurityPolicyImpl::CanReadWriteFileSystem(
 636     int child_id, const std::string& filesystem_id) {
 637   return HasPermissionsForFileSystem(child_id, filesystem_id,
 638                                      READ_FILE_GRANT | WRITE_FILE_GRANT);
 639 }
 640
 641 bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystem(
 642     int child_id, const std::string& filesystem_id) {
 643   return HasPermissionsForFileSystem(child_id, filesystem_id,
 644                                      COPY_INTO_FILE_GRANT);
 645 }
 646
 647 bool ChildProcessSecurityPolicyImpl::CanDeleteFromFileSystem(
 648     int child_id, const std::string& filesystem_id) {
 649   return HasPermissionsForFileSystem(child_id, filesystem_id,
 650                                      DELETE_FILE_GRANT);
 651 }
 652
 653 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFile(
 654     int child_id, const base::FilePath& file, int permissions) {
 655   base::AutoLock lock(lock_);
 656   bool result = ChildProcessHasPermissionsForFile(child_id, file, permissions);
 657   if (!result) {
 658     // If this is a worker thread that has no access to a given file,
 659     // let's check that its renderer process has access to that file instead.
 660     WorkerToMainProcessMap::iterator iter = worker_map_.find(child_id);
 661     if (iter != worker_map_.end() && iter->second != 0) {
 662       result = ChildProcessHasPermissionsForFile(iter->second,
 663                                                  file,
 664                                                  permissions);
 665     }
 666   }
 667   return result;
 668 }
 669
 670 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile(
 671     int child_id,
 672     const storage::FileSystemURL& url,
 673     int permissions) {
 674   if (!url.is_valid())
 675     return false;
 676
 677   if (url.path().ReferencesParent())
 678     return false;
 679
 680   // Any write access is disallowed on the root path.
 681   if (storage::VirtualPath::IsRootPath(url.path()) &&
 682       (permissions & ~READ_FILE_GRANT)) {
 683     return false;
 684   }
 685
 686   if (url.mount_type() == storage::kFileSystemTypeIsolated) {
 687     // When Isolated filesystems is overlayed on top of another filesystem,
 688     // its per-filesystem permission overrides the underlying filesystem
 689     // permissions).
 690     return HasPermissionsForFileSystem(
 691         child_id, url.mount_filesystem_id(), permissions);
 692   }
 693
 694   FileSystemPermissionPolicyMap::iterator found =
 695       file_system_policy_map_.find(url.type());
 696   if (found == file_system_policy_map_.end())
 697     return false;
 698
 699   if ((found->second & storage::FILE_PERMISSION_READ_ONLY) &&
 700       permissions & ~READ_FILE_GRANT) {
 701     return false;
 702   }
 703
 704   if (found->second & storage::FILE_PERMISSION_USE_FILE_PERMISSION)
 705     return HasPermissionsForFile(child_id, url.path(), permissions);
 706
 707   if (found->second & storage::FILE_PERMISSION_SANDBOX)
 708     return true;
 709
 710   return false;
 711 }
 712
 713 bool ChildProcessSecurityPolicyImpl::CanReadFileSystemFile(
 714     int child_id,
 715     const storage::FileSystemURL& url) {
 716   return HasPermissionsForFileSystemFile(child_id, url, READ_FILE_GRANT);
 717 }
 718
 719 bool ChildProcessSecurityPolicyImpl::CanWriteFileSystemFile(
 720     int child_id,
 721     const storage::FileSystemURL& url) {
 722   return HasPermissionsForFileSystemFile(child_id, url, WRITE_FILE_GRANT);
 723 }
 724
 725 bool ChildProcessSecurityPolicyImpl::CanCreateFileSystemFile(
 726     int child_id,
 727     const storage::FileSystemURL& url) {
 728   return HasPermissionsForFileSystemFile(child_id, url, CREATE_NEW_FILE_GRANT);
 729 }
 730
 731 bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFileSystemFile(
 732     int child_id,
 733     const storage::FileSystemURL& url) {
 734   return HasPermissionsForFileSystemFile(child_id, url,
 735                                          CREATE_READ_WRITE_FILE_GRANT);
 736 }
 737
 738 bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystemFile(
 739     int child_id,
 740     const storage::FileSystemURL& url) {
 741   return HasPermissionsForFileSystemFile(child_id, url, COPY_INTO_FILE_GRANT);
 742 }
 743
 744 bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile(
 745     int child_id,
 746     const storage::FileSystemURL& url) {
 747   return HasPermissionsForFileSystemFile(child_id, url, DELETE_FILE_GRANT);
 748 }
 749
 750 bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) {
 751   base::AutoLock lock(lock_);
 752
 753   SecurityStateMap::iterator state = security_state_.find(child_id);
 754   if (state == security_state_.end())
 755     return false;
 756
 757   return state->second->has_web_ui_bindings();
 758 }
 759
 760 bool ChildProcessSecurityPolicyImpl::CanReadRawCookies(int child_id) {
 761   base::AutoLock lock(lock_);
 762
 763   SecurityStateMap::iterator state = security_state_.find(child_id);
 764   if (state == security_state_.end())
 765     return false;
 766
 767   return state->second->can_read_raw_cookies();
 768 }
 769
 770 void ChildProcessSecurityPolicyImpl::AddChild(int child_id) {
 771   if (security_state_.count(child_id) != 0) {
 772     NOTREACHED() << "Add child process at most once.";
 773     return;
 774   }
 775
 776   security_state_[child_id] = new SecurityState();
 777 }
 778
 779 bool ChildProcessSecurityPolicyImpl::ChildProcessHasPermissionsForFile(
 780     int child_id, const base::FilePath& file, int permissions) {
 781   SecurityStateMap::iterator state = security_state_.find(child_id);
 782   if (state == security_state_.end())
 783     return false;
 784   return state->second->HasPermissionsForFile(file, permissions);
 785 }
 786
 787 bool ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin(int child_id,
 788                                                             const GURL& gurl) {
 789   base::AutoLock lock(lock_);
 790   SecurityStateMap::iterator state = security_state_.find(child_id);
 791   if (state == security_state_.end())
 792     return false;
 793   return state->second->CanAccessDataForOrigin(gurl);
 794 }
 795
 796 void ChildProcessSecurityPolicyImpl::LockToOrigin(int child_id,
 797                                                   const GURL& gurl) {
 798   // "gurl" can be currently empty in some cases, such as file://blah.
 799   DCHECK(SiteInstanceImpl::GetSiteForURL(NULL, gurl) == gurl);
 800   base::AutoLock lock(lock_);
 801   SecurityStateMap::iterator state = security_state_.find(child_id);
 802   DCHECK(state != security_state_.end());
 803   state->second->LockToOrigin(gurl);
 804 }
 805
 806 void ChildProcessSecurityPolicyImpl::GrantPermissionsForFileSystem(
 807     int child_id,
 808     const std::string& filesystem_id,
 809     int permission) {
 810   base::AutoLock lock(lock_);
 811
 812   SecurityStateMap::iterator state = security_state_.find(child_id);
 813   if (state == security_state_.end())
 814     return;
 815   state->second->GrantPermissionsForFileSystem(filesystem_id, permission);
 816 }
 817
 818 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystem(
 819     int child_id,
 820     const std::string& filesystem_id,
 821     int permission) {
 822   base::AutoLock lock(lock_);
 823
 824   SecurityStateMap::iterator state = security_state_.find(child_id);
 825   if (state == security_state_.end())
 826     return false;
 827   return state->second->HasPermissionsForFileSystem(filesystem_id, permission);
 828 }
 829
 830 void ChildProcessSecurityPolicyImpl::RegisterFileSystemPermissionPolicy(
 831     storage::FileSystemType type,
 832     int policy) {
 833   base::AutoLock lock(lock_);
 834   file_system_policy_map_[type] = policy;
 835 }
 836
 837 bool ChildProcessSecurityPolicyImpl::CanSendMidiSysExMessage(int child_id) {
 838   base::AutoLock lock(lock_);
 839
 840   SecurityStateMap::iterator state = security_state_.find(child_id);
 841   if (state == security_state_.end())
 842     return false;
 843
 844   return state->second->can_send_midi_sysex();
 845 }
 846
 847 }  // namespace content