[Mac] Add option to reauthenticate the OS user before revealing passwords.

When the flag is enabled and the user attempts to reveal a plaintext password
in chrome://settings/passwords, they will be prompted to reauthenticate with
their OS password. This matches Safari's behaviour on OS X.

BUG=303113

Review URL: https://codereview.chromium.org/28713002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@230479 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 35 insertions, 17 deletions

diff --git a/base/mac/authorization_util.h b/base/mac/authorization_util.h
index b34348d..4629039 100644
--- a/base/mac/authorization_util.h
+++ b/base/mac/authorization_util.h
@@ -33,11 +33,20 @@
 namespace base {
 namespace mac {
 
-// Obtains an AuthorizationRef that can be used to run commands as root.  If
-// necessary, prompts the user for authentication.  If the user is prompted,
+// Obtains an AuthorizationRef for the rights indicated by |rights|.  If
+// necessary, prompts the user for authentication. If the user is prompted,
 // |prompt| will be used as the prompt string and an icon appropriate for the
-// application will be displayed in a prompt dialog.  Note that the system
-// appends its own text to the prompt string.  Returns NULL on failure.
+// application will be displayed in a prompt dialog. Note that the system
+// appends its own text to the prompt string. |extraFlags| will be ORed
+// together with the default flags. Returns NULL on failure.
+BASE_EXPORT
+AuthorizationRef GetAuthorizationRightsWithPrompt(
+    AuthorizationRights* rights,
+    CFStringRef prompt,
+    AuthorizationFlags extraFlags);
+
+// Obtains an AuthorizationRef (using |GetAuthorizationRightsWithPrompt|) that
+// can be used to run commands as root.
 BASE_EXPORT
 AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt);
 
diff --git a/base/mac/authorization_util.mm b/base/mac/authorization_util.mm
index c292589..6cb8de3 100644
--- a/base/mac/authorization_util.mm
+++ b/base/mac/authorization_util.mm
@@ -22,7 +22,10 @@
 namespace base {
 namespace mac {
 
-AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
+AuthorizationRef GetAuthorizationRightsWithPrompt(
+    AuthorizationRights* rights,
+    CFStringRef prompt,
+    AuthorizationFlags extraFlags) {
   // Create an empty AuthorizationRef.
   ScopedAuthorizationRef authorization;
   OSStatus status = AuthorizationCreate(NULL,
@@ -34,12 +37,11 @@ AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
     return NULL;
   }
 
-  // Specify the "system.privilege.admin" right, which allows
-  // AuthorizationExecuteWithPrivileges to run commands as root.
-  AuthorizationItem right_items[] = {
-    {kAuthorizationRightExecute, 0, NULL, 0}
-  };
-  AuthorizationRights rights = {arraysize(right_items), right_items};
+  AuthorizationFlags flags = kAuthorizationFlagDefaults |
+                             kAuthorizationFlagInteractionAllowed |
+                             kAuthorizationFlagExtendRights |
+                             kAuthorizationFlagPreAuthorize |
+                             extraFlags;
 
   // product_logo_32.png is used instead of app.icns because Authorization
   // Services can't deal with .icns files.
@@ -63,16 +65,12 @@ AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
   AuthorizationEnvironment environment = {arraysize(environment_items),
                                           environment_items};
 
-  AuthorizationFlags flags = kAuthorizationFlagDefaults |
-                             kAuthorizationFlagInteractionAllowed |
-                             kAuthorizationFlagExtendRights |
-                             kAuthorizationFlagPreAuthorize;
-
   status = AuthorizationCopyRights(authorization,
-                                   &rights,
+                                   rights,
                                    &environment,
                                    flags,
                                    NULL);
+
   if (status != errAuthorizationSuccess) {
     if (status != errAuthorizationCanceled) {
       OSSTATUS_LOG(ERROR, status) << "AuthorizationCopyRights";
@@ -83,6 +81,17 @@ AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
   return authorization.release();
 }
 
+AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
+  // Specify the "system.privilege.admin" right, which allows
+  // AuthorizationExecuteWithPrivileges to run commands as root.
+  AuthorizationItem right_items[] = {
+    {kAuthorizationRightExecute, 0, NULL, 0}
+  };
+  AuthorizationRights rights = {arraysize(right_items), right_items};
+
+  return GetAuthorizationRightsWithPrompt(&rights, prompt, 0);
+}
+
 OSStatus ExecuteWithPrivilegesAndGetPID(AuthorizationRef authorization,
                                         const char* tool_path,
                                         AuthorizationFlags options,