Fully remove the hole in the Mac Sandbox that was used to support...

chrome/common/sandbox_mac.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_SANDBOX_MAC_H_
 #define CHROME_COMMON_SANDBOX_MAC_H_
 #pragma once
 
 #include "base/file_path.h"
 
 namespace sandbox {
 
 enum SandboxProcessType {
 
   SANDBOX_TYPE_FIRST_TYPE,  // Placeholder to ease iteration.
 
   SANDBOX_TYPE_RENDERER = SANDBOX_TYPE_FIRST_TYPE,
 
   // The worker processes uses the most restrictive sandbox which has almost
   // *everything* locked down. Only a couple of /System/Library/ paths and
   // some other very basic operations (e.g., reading metadata to allow
   // following symlinks) are permitted.
   SANDBOX_TYPE_WORKER,
 
   // Utility process is as restrictive as the worker process except full access
   // is allowed to one configurable directory.
   SANDBOX_TYPE_UTILITY,
 
-  // Native Client sandboxes. The plugin contains trusted code and the
-  // loader contains the user's untrusted code.
-  SANDBOX_TYPE_NACL_PLUGIN,
+  // Native Client sandbox for the user's untrusted code.
   SANDBOX_TYPE_NACL_LOADER,
 
   SANDBOX_AFTER_TYPE_LAST_TYPE,  // Placeholder to ease iteration.
 };
 
 // Warm up System APIs that empirically need to be accessed before the Sandbox
 // is turned on.
 void SandboxWarmup();
 
 // Turns on the OS X sandbox for this process.
@@ skipping 10 matching lines @@
                    const FilePath& allowed_dir);
 
 // Convert provided path into a "canonical" path matching what the Sandbox
 // expects i.e. one without symlinks.
 // This path is not necessarily unique e.g. in the face of hardlinks.
 void GetCanonicalSandboxPath(FilePath* path);
 
 }  // namespace sandbox
 
 #endif  // CHROME_COMMON_SANDBOX_MAC_H_