--- a/extensions/cookie/nsPermissionManager.cpp
+++ b/extensions/cookie/nsPermissionManager.cpp
@@ -15,16 +15,17 @@
 #include "nsTArray.h"
 #include "nsReadableUtils.h"
 #include "nsILineInputStream.h"
 #include "nsIIDNService.h"
 #include "nsAppDirectoryServiceDefs.h"
 #include "prprf.h"
 #include "mozilla/storage.h"
 #include "nsXULAppAPI.h"
+#include "nsIPrincipal.h"
 
 static nsPermissionManager *gPermissionManager = nsnull;
 
 using mozilla::dom::ContentParent;
 using mozilla::dom::ContentChild;
 using mozilla::unused; // ha!
 
 static bool
@@ -497,16 +498,29 @@ nsPermissionManager::Add(nsIURI     *aUR
   nsCAutoString host;
   rv = GetHost(aURI, host);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return AddInternal(host, nsDependentCString(aType), aPermission, 0, 
                      aExpireType, aExpireTime, eNotify, eWriteToDB);
 }
 
+NS_IMETHODIMP
+nsPermissionManager::AddFromPrincipal(nsIPrincipal* aPrincipal,
+                                      const char* aType, PRUint32 aPermission,
+                                      PRUint32 aExpireType, PRInt64 aExpireTime)
+{
+  NS_ENSURE_ARG_POINTER(aPrincipal);
+
+  nsCOMPtr<nsIURI> uri;
+  aPrincipal->GetURI(getter_AddRefs(uri));
+
+  return Add(uri, aType, aPermission, aExpireType, aExpireTime);
+}
+
 nsresult
 nsPermissionManager::AddInternal(const nsAFlatCString &aHost,
                                  const nsAFlatCString &aType,
                                  PRUint32              aPermission,
                                  PRInt64               aID,
                                  PRUint32              aExpireType,
                                  PRInt64               aExpireTime,
                                  NotifyOperationType   aNotifyOperation,
@@ -676,16 +690,32 @@ nsPermissionManager::Remove(const nsACSt
                      0,
                      nsIPermissionManager::EXPIRE_NEVER,
                      0,
                      eNotify,
                      eWriteToDB);
 }
 
 NS_IMETHODIMP
+nsPermissionManager::RemoveFromPrincipal(nsIPrincipal* aPrincipal,
+                                         const char* aType)
+{
+  NS_ENSURE_ARG_POINTER(aPrincipal);
+
+  nsCOMPtr<nsIURI> uri;
+  aPrincipal->GetURI(getter_AddRefs(uri));
+  NS_ENSURE_TRUE(uri, NS_ERROR_FAILURE);
+
+  nsCAutoString host;
+  uri->GetHost(host);
+
+  return Remove(host, aType);
+}
+
+NS_IMETHODIMP
 nsPermissionManager::RemoveAll()
 {
   ENSURE_NOT_CHILD_PROCESS;
   return RemoveAllInternal(true);
 }
 
 void
 nsPermissionManager::CloseDB(bool aRebuildOnSuccess)
@@ -747,16 +777,42 @@ nsPermissionManager::TestExactPermission
 NS_IMETHODIMP
 nsPermissionManager::TestPermission(nsIURI     *aURI,
                                     const char *aType,
                                     PRUint32   *aPermission)
 {
   return CommonTestPermission(aURI, aType, aPermission, false);
 }
 
+NS_IMETHODIMP
+nsPermissionManager::TestPermissionFromPrincipal(nsIPrincipal* aPrincipal,
+                                                 const char* aType,
+                                                 PRUint32* aPermission)
+{
+  NS_ENSURE_ARG_POINTER(aPrincipal);
+
+  nsCOMPtr<nsIURI> uri;
+  aPrincipal->GetURI(getter_AddRefs(uri));
+
+  return TestPermission(uri, aType, aPermission);
+}
+
+NS_IMETHODIMP
+nsPermissionManager::TestExactPermissionFromPrincipal(nsIPrincipal* aPrincipal,
+                                                      const char* aType,
+                                                      PRUint32* aPermission)
+{
+  NS_ENSURE_ARG_POINTER(aPrincipal);
+
+  nsCOMPtr<nsIURI> uri;
+  aPrincipal->GetURI(getter_AddRefs(uri));
+
+  return TestExactPermission(uri, aType, aPermission);
+}
+
 nsresult
 nsPermissionManager::CommonTestPermission(nsIURI     *aURI,
                                           const char *aType,
                                           PRUint32   *aPermission,
                                           bool        aExactHostMatch)
 {
   NS_ENSURE_ARG_POINTER(aURI);
   NS_ENSURE_ARG_POINTER(aType);

--- a/netwerk/base/public/nsIPermissionManager.idl
+++ b/netwerk/base/public/nsIPermissionManager.idl
@@ -28,18 +28,19 @@
  *          the entire permission list was cleared. the subject is null.
  */
 
 #include "nsISupports.idl"
 #include "nsISimpleEnumerator.idl"
 
 interface nsIURI;
 interface nsIObserver;
+interface nsIPrincipal;
 
-[scriptable, uuid(0b83f9d5-3f96-41b6-91aa-ff3a7e4880d7)]
+[scriptable, uuid(cc423aaf-f088-4ec2-86ef-7733225773f9)]
 interface nsIPermissionManager : nsISupports
 {
   /**
    * Predefined return values for the testPermission method and for
    * the permission param of the add method
    * NOTE: UNKNOWN_ACTION (0) is reserved to represent the
    * default permission when no entry is found for a host, and
    * should not be used by consumers to indicate otherwise.
@@ -84,56 +85,84 @@ interface nsIPermissionManager : nsISupp
    */
   void add(in nsIURI uri,
            in string type,
            in PRUint32 permission,
            [optional] in PRUint32 expireType,
            [optional] in PRInt64 expireTime);
 
   /**
+   * Add permission information for a given principal.
+   * It is internally calling the other add() method using the nsIURI from the
+   * principal.
+   */
+  void addFromPrincipal(in nsIPrincipal principal, in string typed,
+                        in PRUint32 permission,
+                        [optional] in PRUint32 expireType,
+                        [optional] in PRInt64 expireTime);
+
+  /**
    * Remove permission information for a given host string and permission type.
    * The host string represents the exact entry in the permission list (such as
    * obtained from the enumerator), not a URI which that permission might apply
    * to.
    *
    * @param host   the host to remove the permission for
    * @param type   a case-sensitive ASCII string, identifying the consumer. 
    *               The type must have been previously registered using the
    *               add() method.
    */
   void remove(in AUTF8String host,
               in string type);
 
   /**
+   * Remove permission information for a given principal.
+   * This is internally calling remove() with the host from the principal's URI.
+   */
+  void removeFromPrincipal(in nsIPrincipal principal, in string type);
+
+  /**
    * Clear permission information for all websites.
    */
   void removeAll();
 
   /**
    * Test whether a website has permission to perform the given action.
    * @param uri     the uri to be tested
    * @param type    a case-sensitive ASCII string, identifying the consumer
    * @param return  see add(), param permission. returns UNKNOWN_ACTION when
    *                there is no stored permission for this uri and / or type.
    */
   PRUint32 testPermission(in nsIURI uri,
                           in string type);
 
   /**
+   * Test whether the principal has the permission to perform a given action.
+   */
+  PRUint32 testPermissionFromPrincipal(in nsIPrincipal principal,
+                                       in string type);
+
+  /**
    * Test whether a website has permission to perform the given action.
    * This requires an exact hostname match, subdomains are not a match.
    * @param uri     the uri to be tested
    * @param type    a case-sensitive ASCII string, identifying the consumer
    * @param return  see add(), param permission. returns UNKNOWN_ACTION when
    *                there is no stored permission for this uri and / or type.
    */
   PRUint32 testExactPermission(in nsIURI uri,
                                in string type);
 
   /**
+   * See testExactPermission() above.
+   */
+  PRUint32 testExactPermissionFromPrincipal(in nsIPrincipal principal,
+                                            in string type);
+
+  /**
    * Allows enumeration of all stored permissions
    * @return an nsISimpleEnumerator interface that allows access to
    *         nsIPermission objects
    */
   readonly attribute nsISimpleEnumerator enumerator;
 };
 
 %{ C++