mac: Don't require DYLD_LIBRARY_PATH to be set when using the shared build.

content/common/sandbox_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_mac.h"
 
 #import <Cocoa/Cocoa.h>
 
 extern "C" {
 #include <sandbox.h>
@@ skipping 253 matching lines @@
     CGImageSourceGetStatus(img);
   }
 
   {
     // Allow access to /dev/urandom.
     GetUrandomFD();
   }
 
   // Process-type dependent warm-up.
   if (sandbox_type == content::SANDBOX_TYPE_GPU) {
-     // Preload either the desktop GL or the osmesa so, depending on the
-     // --use-gl flag.
-     gfx::GLSurface::InitializeOneOff();
+    // Preload either the desktop GL or the osmesa so, depending on the
+    // --use-gl flag.
+    gfx::GLSurface::InitializeOneOff();
   }
 }
 
 // static
 NSString* Sandbox::BuildAllowDirectoryAccessSandboxString(
     const FilePath& allowed_dir,
     SandboxVariableSubstitions* substitutions) {
   // A whitelist is used to determine which directories can be statted
   // This means that in the case of an /a/b/c/d/ directory, we may be able to
   // stat the leaf directory, but not its parent.
@@ skipping 86 matching lines @@
   }
 
   base::StringPiece common_sandbox_definition =
       content::GetContentClient()->GetDataResource(
           IDR_COMMON_SANDBOX_PROFILE, ui::SCALE_FACTOR_NONE);
   if (common_sandbox_definition.empty()) {
     LOG(FATAL) << "Failed to load the common sandbox profile";
     return nil;
   }
 
-  scoped_nsobject<NSString> common_sandbox_prefix_data(
-      [[NSString alloc] initWithBytes:common_sandbox_definition.data()
-                               length:common_sandbox_definition.length()
-                             encoding:NSUTF8StringEncoding]);
+  NSString* common_sandbox_prefix_data =

[Mark Mentovai, 2012/05/30 13:38:22]

I’m leery of taking this out of the scoped_nsobject that it had been in, since I
can’t easily see the autorelease pool that surrounds this, and it might just be
the big early-startup one. 

[Nico, 2012/05/30 15:03:29]

Done.

+      [[[NSString alloc] initWithBytes:common_sandbox_definition.data()
+                                length:common_sandbox_definition.length()
+                              encoding:NSUTF8StringEncoding] autorelease];
+
+#if defined(COMPONENT_BUILD)
+  // dlopen() fails without file-read-metadata access if the executable image
+  // contains LC_RPATH load commands. The components build uses those.
+  // See http://crbug.com/127465
+  if (base::mac::IsOSSnowLeopardOrEarlier()) {
+    common_sandbox_prefix_data = [common_sandbox_prefix_data
+        stringByAppendingString:@"\n(allow file-read-metadata)\n"];
+  }
+#endif
 
   scoped_nsobject<NSString> sandbox_data(
       [[NSString alloc] initWithBytes:sandbox_definition.data()
                                length:sandbox_definition.length()
                              encoding:NSUTF8StringEncoding]);
 
   // Prefix sandbox_data with common_sandbox_prefix_data.
   return [common_sandbox_prefix_data stringByAppendingString:sandbox_data];
 }
 
@@ skipping 181 matching lines @@
   if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) {
     DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                  << path->value();
     return;
   }
 
   *path = FilePath(canonical_path);
 }
 
 }  // namespace sandbox