NaCl: enable meta-based validation for shared libraries.

This is the Chrome-side half of a CL to allow mmaping and skipping validation
for chrome-extension: files we have seen before and know are safe.  To do this
we need to know the path of the file on disk, but we don't entirely trust the
renderer not to tamper with it.  To work around this, a nonce is passed along
with the file handle.  This nonce can be used by the NaCl process to acquire the
file handle directly from the browser process, as well as a fresh copy of the
file handle.

This change significantly revises the OpenNaClExecutable method of the
PPB_NaCl_Private interface.  The method was added anticipation of this CL, but
the overall design shifted after the method was added.

BUG=https://code.google.com/p/chromium/issues/detail?id=224434

Review URL: https://chromiumcodereview.appspot.com/14750007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@202278 0039d316-1c4b-4281-b951-d872f2087c98

8 files changed, 101 insertions, 91 deletions

diff --git a/ppapi/api/private/ppb_nacl_private.idl b/ppapi/api/private/ppb_nacl_private.idl
index b1f47ce..c871178 100644
--- a/ppapi/api/private/ppb_nacl_private.idl
+++ b/ppapi/api/private/ppb_nacl_private.idl
@@ -34,12 +34,6 @@ enum PP_NaClError {
   PP_NACL_MANIFEST_MISSING_ARCH = 0
 };
 
-struct PP_NaClExecutableMetadata {
-  /** File path of NaCl executable. This is created by the OpenNaClExecutableFd
-   *  function. It is the caller's responsiblity to release it. */
-  PP_Var file_path;
-};
-
 /* PPB_NaCl_Private */
 interface PPB_NaCl_Private {
   /* Launches NaCl's sel_ldr process.  Returns PP_NACL_OK on success and
@@ -129,5 +123,6 @@ interface PPB_NaCl_Private {
    */
   PP_FileHandle OpenNaClExecutable([in] PP_Instance instance,
                                    [in] str_t file_url,
-                                   [out] PP_NaClExecutableMetadata metadata);
+                                   [out] uint64_t file_token_lo,
+                                   [out] uint64_t file_token_hi);
 };
diff --git a/ppapi/c/private/ppb_nacl_private.h b/ppapi/c/private/ppb_nacl_private.h
index 8e40fd8..72b62e9 100644
--- a/ppapi/c/private/ppb_nacl_private.h
+++ b/ppapi/c/private/ppb_nacl_private.h
@@ -3,7 +3,7 @@
  * found in the LICENSE file.
  */
 
-/* From private/ppb_nacl_private.idl modified Mon Apr 22 22:25:20 2013. */
+/* From private/ppb_nacl_private.idl modified Fri May 17 13:21:13 2013. */
 
 #ifndef PPAPI_C_PRIVATE_PPB_NACL_PRIVATE_H_
 #define PPAPI_C_PRIVATE_PPB_NACL_PRIVATE_H_
@@ -12,7 +12,6 @@
 #include "ppapi/c/pp_instance.h"
 #include "ppapi/c/pp_macros.h"
 #include "ppapi/c/pp_stdint.h"
-#include "ppapi/c/pp_var.h"
 
 #define PPB_NACL_PRIVATE_INTERFACE_1_0 "PPB_NaCl_Private;1.0"
 #define PPB_NACL_PRIVATE_INTERFACE PPB_NACL_PRIVATE_INTERFACE_1_0
@@ -57,19 +56,6 @@ typedef enum {
  */
 
 /**
- * @addtogroup Structs
- * @{
- */
-struct PP_NaClExecutableMetadata {
-  /** File path of NaCl executable. This is created by the OpenNaClExecutableFd
-   *  function. It is the caller's responsiblity to release it. */
-  struct PP_Var file_path;
-};
-/**
- * @}
- */
-
-/**
  * @addtogroup Interfaces
  * @{
  */
@@ -149,10 +135,10 @@ struct PPB_NaCl_Private_1_0 {
    * corresponding to the file URL and returns a file descriptor, or an invalid
    * handle on failure. |metadata| is left unchanged on failure.
    */
-  PP_FileHandle (*OpenNaClExecutable)(
-      PP_Instance instance,
-      const char* file_url,
-      struct PP_NaClExecutableMetadata* metadata);
+  PP_FileHandle (*OpenNaClExecutable)(PP_Instance instance,
+                                      const char* file_url,
+                                      uint64_t* file_token_lo,
+                                      uint64_t* file_token_hi);
 };
 
 typedef struct PPB_NaCl_Private_1_0 PPB_NaCl_Private;
diff --git a/ppapi/native_client/src/trusted/plugin/file_downloader.cc b/ppapi/native_client/src/trusted/plugin/file_downloader.cc
index ce7fe30..17081242 100644
--- a/ppapi/native_client/src/trusted/plugin/file_downloader.cc
+++ b/ppapi/native_client/src/trusted/plugin/file_downloader.cc
@@ -5,6 +5,7 @@
 #include "native_client/src/trusted/plugin/file_downloader.h"
 
 #include <stdio.h>
+#include <string.h>
 #include <string>
 
 #include "native_client/src/include/portability_io.h"
@@ -21,8 +22,17 @@
 #include "ppapi/cpp/url_response_info.h"
 
 namespace {
+
 const int32_t kExtensionUrlRequestStatusOk = 200;
 const int32_t kDataUriRequestStatusOk = 0;
+
+struct NaClFileInfo NoFileInfo() {
+  struct NaClFileInfo info;
+  memset(&info, 0, sizeof(info));
+  info.desc = -1;
+  return info;
+}
+
 }
 
 namespace plugin {
@@ -145,7 +155,8 @@ bool FileDownloader::Open(
 }
 
 void FileDownloader::OpenFast(const nacl::string& url,
-                              PP_FileHandle file_handle) {
+                              PP_FileHandle file_handle,
+                              uint64_t file_token_lo, uint64_t file_token_hi) {
   PLUGIN_PRINTF(("FileDownloader::OpenFast (url=%s)\n", url.c_str()));
   CHECK(instance_ != NULL);
   open_time_ = NaClGetTimeOfDayMicroseconds();
@@ -154,9 +165,12 @@ void FileDownloader::OpenFast(const nacl::string& url,
   url_ = url;
   mode_ = DOWNLOAD_NONE;
   file_handle_ = file_handle;
+  file_token_.lo = file_token_lo;
+  file_token_.hi = file_token_hi;
 }
 
-int32_t FileDownloader::GetPOSIXFileDescriptor() {
+struct NaClFileInfo FileDownloader::GetFileInfo() {
+  struct NaClFileInfo info = NoFileInfo();
   int32_t file_desc = NACL_NO_FILE_DESC;
   if (not_streaming() && file_handle_ != PP_kInvalidFileHandle) {
 #if NACL_WINDOWS
@@ -165,13 +179,14 @@ int32_t FileDownloader::GetPOSIXFileDescriptor() {
 #else
     file_desc = file_handle_;
 #endif
+    info.file_token = file_token_;
   } else {
     if (!streaming_to_file()) {
-      return NACL_NO_FILE_DESC;
+      return NoFileInfo();
     }
     // Use the trusted interface to get the file descriptor.
     if (file_io_trusted_interface_ == NULL) {
-      return NACL_NO_FILE_DESC;
+      return NoFileInfo();
     }
     file_desc = file_io_trusted_interface_->GetOSFileDescriptor(
         file_reader_.pp_resource());
@@ -183,12 +198,13 @@ int32_t FileDownloader::GetPOSIXFileDescriptor() {
   if (posix_desc == -1) {
     // Close the Windows HANDLE if it can't be converted.
     CloseHandle(reinterpret_cast<HANDLE>(file_desc));
-    return NACL_NO_FILE_DESC;
+    return NoFileInfo();
   }
   file_desc = posix_desc;
 #endif
 
-  return file_desc;
+  info.desc = file_desc;
+  return info;
 }
 
 int64_t FileDownloader::TimeSinceOpenMilliseconds() const {
diff --git a/ppapi/native_client/src/trusted/plugin/file_downloader.h b/ppapi/native_client/src/trusted/plugin/file_downloader.h
index a60c837..7d87930 100644
--- a/ppapi/native_client/src/trusted/plugin/file_downloader.h
+++ b/ppapi/native_client/src/trusted/plugin/file_downloader.h
@@ -10,6 +10,7 @@
 #include "native_client/src/include/nacl_macros.h"
 #include "native_client/src/include/nacl_string.h"
 #include "native_client/src/trusted/plugin/callback_source.h"
+#include "native_client/src/trusted/validator/nacl_file_info.h"
 #include "ppapi/c/private/pp_file_handle.h"
 #include "ppapi/c/trusted/ppb_file_io_trusted.h"
 #include "ppapi/c/trusted/ppb_url_loader_trusted.h"
@@ -85,14 +86,16 @@ class FileDownloader {
                   StreamCallbackSource* stream_callback_source);
 
   // Bypasses downloading and takes a handle to the open file. To get the fd,
-  // call GetPOSIXFileDescriptor().
-  void OpenFast(const nacl::string& url, PP_FileHandle file_handle);
+  // call GetFileInfo().
+  void OpenFast(const nacl::string& url, PP_FileHandle file_handle,
+                uint64_t file_token_lo, uint64_t file_token_hi);
 
+  // Return a structure describing the file opened, including a file desc.
   // If downloading and opening succeeded, this returns a valid read-only
   // POSIX file descriptor.  On failure, the return value is an invalid
   // descriptor.  The file descriptor is owned by this instance, so the
   // delegate does not have to close it.
-  int32_t GetPOSIXFileDescriptor();
+  struct NaClFileInfo GetFileInfo();
 
   // Returns the time delta between the call to Open() and this function.
   int64_t TimeSinceOpenMilliseconds() const;
@@ -160,6 +163,7 @@ class FileDownloader {
   pp::CompletionCallback file_open_notify_callback_;
   pp::FileIO file_reader_;
   PP_FileHandle file_handle_;
+  struct NaClFileToken file_token_;
   const PPB_FileIOTrusted* file_io_trusted_interface_;
   const PPB_URLLoaderTrusted* url_loader_trusted_interface_;
   pp::URLLoader url_loader_;
diff --git a/ppapi/native_client/src/trusted/plugin/plugin.cc b/ppapi/native_client/src/trusted/plugin/plugin.cc
index 34b487d..cd5dfbf 100644
--- a/ppapi/native_client/src/trusted/plugin/plugin.cc
+++ b/ppapi/native_client/src/trusted/plugin/plugin.cc
@@ -802,16 +802,16 @@ void Plugin::HistogramStartupTimeMedium(const std::string& name, float dt) {
 void Plugin::NexeFileDidOpen(int32_t pp_error) {
   PLUGIN_PRINTF(("Plugin::NexeFileDidOpen (pp_error=%"NACL_PRId32")\n",
                  pp_error));
-  int32_t file_desc = nexe_downloader_.GetPOSIXFileDescriptor();
+  struct NaClFileInfo info = nexe_downloader_.GetFileInfo();
   PLUGIN_PRINTF(("Plugin::NexeFileDidOpen (file_desc=%"NACL_PRId32")\n",
-                 file_desc));
+                 info.desc));
   HistogramHTTPStatusCode(
       is_installed_ ?
           "NaCl.HttpStatusCodeClass.Nexe.InstalledApp" :
           "NaCl.HttpStatusCodeClass.Nexe.NotInstalledApp",
       nexe_downloader_.status_code());
   ErrorInfo error_info;
-  if (pp_error != PP_OK || file_desc == NACL_NO_FILE_DESC) {
+  if (pp_error != PP_OK || info.desc == NACL_NO_FILE_DESC) {
     if (pp_error == PP_ERROR_ABORTED) {
       ReportLoadAbort();
     } else if (pp_error == PP_ERROR_NOACCESS) {
@@ -824,7 +824,7 @@ void Plugin::NexeFileDidOpen(int32_t pp_error) {
     }
     return;
   }
-  int32_t file_desc_ok_to_close = DUP(file_desc);
+  int32_t file_desc_ok_to_close = DUP(info.desc);
   if (file_desc_ok_to_close == NACL_NO_FILE_DESC) {
     error_info.SetReport(ERROR_NEXE_FH_DUP,
                          "could not duplicate loaded file handle.");
@@ -1083,10 +1083,10 @@ void Plugin::NaClManifestFileDidOpen(int32_t pp_error) {
   // The manifest file was successfully opened.  Set the src property on the
   // plugin now, so that the full url is available to error handlers.
   set_manifest_url(nexe_downloader_.url());
-  int32_t file_desc = nexe_downloader_.GetPOSIXFileDescriptor();
+  struct NaClFileInfo info = nexe_downloader_.GetFileInfo();
   PLUGIN_PRINTF(("Plugin::NaClManifestFileDidOpen (file_desc=%"
-                 NACL_PRId32")\n", file_desc));
-  if (pp_error != PP_OK || file_desc == NACL_NO_FILE_DESC) {
+                 NACL_PRId32")\n", info.desc));
+  if (pp_error != PP_OK || info.desc == NACL_NO_FILE_DESC) {
     if (pp_error == PP_ERROR_ABORTED) {
       ReportLoadAbort();
     } else if (pp_error == PP_ERROR_NOACCESS) {
@@ -1102,7 +1102,7 @@ void Plugin::NaClManifestFileDidOpen(int32_t pp_error) {
   }
   // SlurpFile closes the file descriptor after reading (or on error).
   // Duplicate our file descriptor since it will be handled by the browser.
-  int dup_file_desc = DUP(file_desc);
+  int dup_file_desc = DUP(info.desc);
   nacl::string json_buffer;
   file_utils::StatusCode status = file_utils::SlurpFile(
       dup_file_desc, json_buffer, kNaClManifestMaxFileBytes);
@@ -1274,28 +1274,32 @@ void Plugin::UrlDidOpenForStreamAsFile(int32_t pp_error,
                  static_cast<void*>(url_downloader)));
   url_downloaders_.erase(url_downloader);
   nacl::scoped_ptr<FileDownloader> scoped_url_downloader(url_downloader);
-  int32_t file_desc = scoped_url_downloader->GetPOSIXFileDescriptor();
+  struct NaClFileInfo info = scoped_url_downloader->GetFileInfo();
 
   if (pp_error != PP_OK) {
     PP_RunCompletionCallback(&callback, pp_error);
-  } else if (file_desc > NACL_NO_FILE_DESC) {
-    url_fd_map_[url_downloader->url_to_open()] = file_desc;
+  } else if (info.desc > NACL_NO_FILE_DESC) {
+    url_file_info_map_[url_downloader->url_to_open()] = info;
     PP_RunCompletionCallback(&callback, PP_OK);
   } else {
     PP_RunCompletionCallback(&callback, PP_ERROR_FAILED);
   }
 }
 
-int32_t Plugin::GetPOSIXFileDesc(const nacl::string& url) {
-  PLUGIN_PRINTF(("Plugin::GetFileDesc (url=%s)\n", url.c_str()));
-  int32_t file_desc_ok_to_close = NACL_NO_FILE_DESC;
-  std::map<nacl::string, int32_t>::iterator it = url_fd_map_.find(url);
-  if (it != url_fd_map_.end())
-    file_desc_ok_to_close = DUP(it->second);
-  return file_desc_ok_to_close;
+struct NaClFileInfo Plugin::GetFileInfo(const nacl::string& url) {
+  struct NaClFileInfo info;
+  memset(&info, 0, sizeof(info));
+  std::map<nacl::string, struct NaClFileInfo>::iterator it =
+      url_file_info_map_.find(url);
+  if (it != url_file_info_map_.end()) {
+    info = it->second;
+    info.desc = DUP(info.desc);
+  } else {
+    info.desc = -1;
+  }
+  return info;
 }
 
-
 bool Plugin::StreamAsFile(const nacl::string& url,
                           PP_CompletionCallback callback) {
   PLUGIN_PRINTF(("Plugin::StreamAsFile (url='%s')\n", url.c_str()));
@@ -1574,25 +1578,18 @@ bool Plugin::OpenURLFast(const nacl::string& url,
   if (!DocumentCanRequest(url))
     return false;
 
-  PP_NaClExecutableMetadata file_metadata;
+  uint64_t file_token_lo = 0;
+  uint64_t file_token_hi = 0;
   PP_FileHandle file_handle =
       nacl_interface()->OpenNaClExecutable(pp_instance(),
                                            url.c_str(),
-                                           &file_metadata);
+                                           &file_token_lo, &file_token_hi);
   // We shouldn't hit this if the file URL is in an installed app.
   if (file_handle == PP_kInvalidFileHandle)
     return false;
 
-  // Release the PP_Var in the metadata struct.
-  pp::Module* module = pp::Module::Get();
-  const PPB_Var* var_interface =
-      static_cast<const PPB_Var*>(
-          module->GetBrowserInterface(PPB_VAR_INTERFACE));
-  var_interface->Release(file_metadata.file_path);
-
   // FileDownloader takes ownership of the file handle.
-  // TODO(bbudge) Consume metadata once we have the final format.
-  downloader->OpenFast(url, file_handle);
+  downloader->OpenFast(url, file_handle, file_token_lo, file_token_hi);
   return true;
 }
 
diff --git a/ppapi/native_client/src/trusted/plugin/plugin.h b/ppapi/native_client/src/trusted/plugin/plugin.h
index 37bcfdd..eecddc6 100644
--- a/ppapi/native_client/src/trusted/plugin/plugin.h
+++ b/ppapi/native_client/src/trusted/plugin/plugin.h
@@ -24,6 +24,7 @@
 #include "native_client/src/trusted/plugin/pnacl_coordinator.h"
 #include "native_client/src/trusted/plugin/service_runtime.h"
 #include "native_client/src/trusted/plugin/utility.h"
+#include "native_client/src/trusted/validator/nacl_file_info.h"
 
 #include "ppapi/c/private/ppb_nacl_private.h"
 #include "ppapi/cpp/private/var_private.h"
@@ -252,9 +253,11 @@ class Plugin : public pp::InstancePrivate {
   // corresponding to the url body is recorded for further lookup.
   bool StreamAsFile(const nacl::string& url,
                     PP_CompletionCallback pp_callback);
-  // Returns an open POSIX file descriptor retrieved by StreamAsFile()
-  // or NACL_NO_FILE_DESC. The caller must take ownership of the descriptor.
-  int32_t GetPOSIXFileDesc(const nacl::string& url);
+
+  // Returns rich information for a file retrieved by StreamAsFile(). This info
+  // contains a file descriptor. The caller must take ownership of this
+  // descriptor.
+  struct NaClFileInfo GetFileInfo(const nacl::string& url);
 
   // A helper function that gets the scheme type for |url|. Uses URLUtil_Dev
   // interface which this class has as a member.
@@ -475,7 +478,7 @@ class Plugin : public pp::InstancePrivate {
   std::set<FileDownloader*> url_downloaders_;
   // Keep track of file descriptors opened by StreamAsFile().
   // These are owned by the browser.
-  std::map<nacl::string, int32_t> url_fd_map_;
+  std::map<nacl::string, struct NaClFileInfo> url_file_info_map_;
 
   // Pending progress events.
   std::queue<ProgressEvent*> progress_events_;
diff --git a/ppapi/native_client/src/trusted/plugin/service_runtime.cc b/ppapi/native_client/src/trusted/plugin/service_runtime.cc
index ba21a49..6c44bc4 100644
--- a/ppapi/native_client/src/trusted/plugin/service_runtime.cc
+++ b/ppapi/native_client/src/trusted/plugin/service_runtime.cc
@@ -46,11 +46,10 @@
 #include "native_client/src/trusted/plugin/pnacl_resources.h"
 #include "native_client/src/trusted/plugin/sel_ldr_launcher_chrome.h"
 #include "native_client/src/trusted/plugin/srpc_client.h"
-
-#include "native_client/src/trusted/weak_ref/call_on_main_thread.h"
-
 #include "native_client/src/trusted/service_runtime/nacl_error_code.h"
 #include "native_client/src/trusted/service_runtime/include/sys/nacl_imc_api.h"
+#include "native_client/src/trusted/validator/nacl_file_info.h"
+#include "native_client/src/trusted/weak_ref/call_on_main_thread.h"
 
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/trusted/ppb_file_io_trusted.h"
@@ -172,11 +171,15 @@ bool PluginReverseInterface::EnumerateManifestKeys(
 // and invoke StreamAsFile with a completion callback that invokes
 // GetPOSIXFileDesc.
 bool PluginReverseInterface::OpenManifestEntry(nacl::string url_key,
-                                               int32_t* out_desc) {
+                                               struct NaClFileInfo* info) {
   ErrorInfo error_info;
   bool op_complete = false;  // NB: mu_ and cv_ also controls access to this!
+  // The to_open object is owned by the weak ref callback. Because this function
+  // waits for the callback to finish, the to_open object will be deallocated on
+  // the main thread before this function can return. The pointers it contains
+  // to stack variables will not leak.
   OpenManifestEntryResource* to_open =
-      new OpenManifestEntryResource(url_key, out_desc,
+      new OpenManifestEntryResource(url_key, info,
                                     &error_info, &op_complete);
   CHECK(to_open != NULL);
   NaClLog(4, "PluginReverseInterface::OpenManifestEntry: %s\n",
@@ -228,8 +231,8 @@ bool PluginReverseInterface::OpenManifestEntry(nacl::string url_key,
   NaClLog(4,
           "PluginReverseInterface::OpenManifestEntry:"
           " *out_desc = %d\n",
-          *out_desc);
-  if (*out_desc == -1) {
+          info->desc);
+  if (info->desc == -1) {
     // TODO(bsy,ncbray): what else should we do with the error?  This
     // is a runtime error that may simply be a programming error in
     // the untrusted code, or it may be something else wrong w/ the
@@ -267,7 +270,7 @@ void PluginReverseInterface::OpenManifestEntry_MainThreadContinuation(
     // up requesting thread -- we are done.
     nacl::MutexLocker take(&mu_);
     *p->op_complete_ptr = true;  // done...
-    *p->out_desc = -1;       // but failed.
+    p->file_info->desc = -1;  // but failed.
     NaClXCondVarBroadcast(&cv_);
     return;
   }
@@ -294,7 +297,7 @@ void PluginReverseInterface::OpenManifestEntry_MainThreadContinuation(
                 "StreamAsFile failed\n");
         nacl::MutexLocker take(&mu_);
         *p->op_complete_ptr = true;  // done...
-        *p->out_desc = -1;       // but failed.
+        p->file_info->desc = -1;       // but failed.
         p->error_info->SetReport(ERROR_MANIFEST_OPEN,
                                  "ServiceRuntime: StreamAsFile failed");
         NaClXCondVarBroadcast(&cv_);
@@ -321,7 +324,9 @@ void PluginReverseInterface::OpenManifestEntry_MainThreadContinuation(
       }
       nacl::MutexLocker take(&mu_);
       *p->op_complete_ptr = true;  // done!
-      *p->out_desc = fd;
+      // TODO(ncbray): enable the fast loading and validation paths for this
+      // type of file.
+      p->file_info->desc = fd;
       NaClXCondVarBroadcast(&cv_);
       NaClLog(4,
               "OpenManifestEntry_MainThreadContinuation: GetPnaclFd okay\n");
@@ -347,7 +352,7 @@ void PluginReverseInterface::OpenManifestEntry_MainThreadContinuation(
     } else {
       nacl::MutexLocker take(&mu_);
       *p->op_complete_ptr = true;  // done...
-      *p->out_desc = -1;       // but failed.
+      p->file_info->desc = -1;  // but failed.
       p->error_info->SetReport(ERROR_PNACL_NOT_ENABLED,
                                "ServiceRuntime: GetPnaclFd failed -- pnacl not "
                                "enabled with --enable-pnacl.");
@@ -366,16 +371,17 @@ void PluginReverseInterface::StreamAsFile_MainThreadContinuation(
 
   nacl::MutexLocker take(&mu_);
   if (result == PP_OK) {
-    NaClLog(4, "StreamAsFile_MainThreadContinuation: GetPOSIXFileDesc(%s)\n",
+    NaClLog(4, "StreamAsFile_MainThreadContinuation: GetFileInfo(%s)\n",
             p->url.c_str());
-    *p->out_desc = plugin_->GetPOSIXFileDesc(p->url);
+    *p->file_info = plugin_->GetFileInfo(p->url);
+
     NaClLog(4,
             "StreamAsFile_MainThreadContinuation: PP_OK, desc %d\n",
-            *p->out_desc);
+            p->file_info->desc);
   } else {
     NaClLog(4,
             "StreamAsFile_MainThreadContinuation: !PP_OK, setting desc -1\n");
-    *p->out_desc = -1;
+    p->file_info->desc = -1;
     p->error_info->SetReport(ERROR_MANIFEST_OPEN,
                              "Plugin StreamAsFile failed at callback");
   }
@@ -397,16 +403,16 @@ void PluginReverseInterface::BitcodeTranslate_MainThreadContinuation(
     // accepts NaClDescs we can avoid this downcast.
     NaClDesc* desc = pnacl_coordinator_->ReleaseTranslatedFD()->desc();
     struct NaClDescIoDesc* ndiodp = (struct NaClDescIoDesc*)desc;
-    *p->out_desc = ndiodp->hd->d;
+    p->file_info->desc = ndiodp->hd->d;
     pnacl_coordinator_.reset(NULL);
     NaClLog(4,
             "BitcodeTranslate_MainThreadContinuation: PP_OK, desc %d\n",
-            *p->out_desc);
+            p->file_info->desc);
   } else {
     NaClLog(4,
             "BitcodeTranslate_MainThreadContinuation: !PP_OK, "
             "setting desc -1\n");
-    *p->out_desc = -1;
+    p->file_info->desc = -1;
     // Error should have been reported by pnacl coordinator.
     NaClLog(LOG_ERROR, "PluginReverseInterface::BitcodeTranslate error.\n");
   }
diff --git a/ppapi/native_client/src/trusted/plugin/service_runtime.h b/ppapi/native_client/src/trusted/plugin/service_runtime.h
index a7eca38..6c6bced 100644
--- a/ppapi/native_client/src/trusted/plugin/service_runtime.h
+++ b/ppapi/native_client/src/trusted/plugin/service_runtime.h
@@ -27,6 +27,8 @@
 #include "ppapi/c/trusted/ppb_file_io_trusted.h"
 #include "ppapi/cpp/completion_callback.h"
 
+struct NaClFileInfo;
+
 namespace nacl {
 class DescWrapper;
 }  // namespace
@@ -63,15 +65,15 @@ struct PostMessageResource {
 struct OpenManifestEntryResource {
  public:
   OpenManifestEntryResource(const std::string& target_url,
-                            int32_t* descp,
+                            struct NaClFileInfo* finfo,
                             ErrorInfo* infop,
                             bool* op_complete)
       : url(target_url),
-        out_desc(descp),
+        file_info(finfo),
         error_info(infop),
         op_complete_ptr(op_complete) {}
   std::string url;
-  int32_t* out_desc;
+  struct NaClFileInfo* file_info;
   ErrorInfo* error_info;
   bool* op_complete_ptr;
 };
@@ -152,7 +154,8 @@ class PluginReverseInterface: public nacl::ReverseInterface {
 
   virtual bool EnumerateManifestKeys(std::set<nacl::string>* out_keys);
 
-  virtual bool OpenManifestEntry(nacl::string url_key, int32_t* out_desc);
+  virtual bool OpenManifestEntry(nacl::string url_key,
+                                 struct NaClFileInfo *info);
 
   virtual bool CloseManifestEntry(int32_t desc);