Merge pull request #452 from electron/fix-catalog-vuln

add patch to fix catalog vuln

patches/076_patch_catalog_vuln.patch

@@ -0,0 +1,49 @@
+Several services require "app" capability from all other services
+(wildcard), which is in itself probably a Bad Thing; but it's
+especially bad now because the catalog service exposes module
+directory access through its app capability.
+
+This changes the catalog manifest to move the capability to a
+different more specific capability, and updates two of its
+consumers.
+---
+
+diff --git a/services/catalog/manifest.json b/services/catalog/manifest.json
+index 4fd82fd..4b31651 100644
+--- a/services/catalog/manifest.json
++++ b/services/catalog/manifest.json
+@@ -9,7 +9,7 @@
+     // build time or something. Same with service:service_manager.
+     "service_manager:connector": {
+       "provides": {
+-        "app": [ "filesystem::mojom::Directory" ],
++        "directory": [ "filesystem::mojom::Directory" ],
+         "control": [ "catalog::mojom::CatalogControl" ]
+       },
+       "requires": {
+ diff --git a/services/ui/manifest.json b/services/ui/manifest.json
+ index 3e7df92..dfd2c55 100644
+ --- a/services/ui/manifest.json
+ +++ b/services/ui/manifest.json
+ @@ -76,7 +76,7 @@
+       },
+       "requires": {
+         "*": [ "app" ],
+ -        "catalog": [ "app" ],
+ +        "catalog": [ "directory" ],
+         "service_manager": [ "service_manager:all_users" ],
+         "ui": [ "ozone" ],
+         "viz": [ "viz_host" ]
+diff --git a/services/service_manager/service_manager.cc b/services/service_manager/service_manager.cc
+index f25a789..2d984f8 100644
+--- a/services/service_manager/service_manager.cc
++++ b/services/service_manager/service_manager.cc
+@@ -1050,7 +1050,7 @@
+   // TODO(beng): It'd be great to build this from the manifest, however there's
+   //             a bit of a chicken-and-egg problem.
+   InterfaceProviderSpec spec;
+-  spec.provides["app"].insert("filesystem::mojom::Directory");
++  spec.provides["directory"].insert("filesystem::mojom::Directory");
+   spec.provides["catalog:catalog"].insert("catalog::mojom::Catalog");
+   spec.provides["control"].insert("catalog::mojom::CatalogControl");
+   InterfaceProviderSpecMap specs;