[Mac] Disable all sandboxd logging unless running with --enable-sandbox-logging.

chrome/common/sandbox_mac.mm

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/sandbox_mac.h"
 
 #include "base/debug_util.h"
 
 #import <Cocoa/Cocoa.h>
 extern "C" {
@@ skipping 291 matching lines @@
   if (!sandbox_data) {
     LOG(FATAL) << "Failed to find the sandbox profile on disk "
                << [sandbox_profile_path fileSystemRepresentation];
     return false;
   }
 
   // Prefix sandbox_data with common_sandbox_prefix_data.
   sandbox_data =
       [common_sandbox_prefix_data stringByAppendingString:sandbox_data];
 
-  // Enable verbose logging if enabled on the command line.
-  // (see renderer.sb for details).
+  // Enable verbose logging if enabled on the command line. (See common.sb
+  // for details).
   const CommandLine *command_line = CommandLine::ForCurrentProcess();
-  if (command_line->HasSwitch(switches::kEnableSandboxLogging)) {
+  bool enable_logging =
+      command_line->HasSwitch(switches::kEnableSandboxLogging);
+  if (enable_logging) {
     sandbox_data = [sandbox_data
         stringByReplacingOccurrencesOfString:@";ENABLE_LOGGING"
                                   withString:@""];
   }
 
+  // Get the OS version.
+  int32 major_version, minor_version, bugfix_version;
+  base::SysInfo::OperatingSystemVersionNumbers(&major_version,
+      &minor_version, &bugfix_version);
+  bool snow_leopard_or_higher =
+      (major_version > 10 || (major_version == 10 && minor_version >= 6));
+
+  // Without this, the sandbox will print a message to the system log every
+  // time it denies a request.  This floods the console with useless spew. The
+  // (with no-log) syntax is only supported on 10.6+
+  if (snow_leopard_or_higher && !enable_logging) {
+    sandbox_data = [sandbox_data
+        stringByReplacingOccurrencesOfString:@"DISABLE_SANDBOX_DENIAL_LOGGING"
+                                  withString:@"(with no-log)"];
+  } else {
+    sandbox_data = [sandbox_data
+        stringByReplacingOccurrencesOfString:@"DISABLE_SANDBOX_DENIAL_LOGGING"
+                                  withString:@""];
+  }
+
   if (!allowed_dir.empty()) {
     // The sandbox only understands "real" paths.  This resolving step is
     // needed so the caller doesn't need to worry about things like /var
     // being a link to /private/var (like in the paths CreateNewTempDirectory()
     // returns).
     FilePath allowed_dir_canonical(allowed_dir);
     GetCanonicalSandboxPath(&allowed_dir_canonical);
 
     std::string allowed_dir_escaped;
     if (!QuoteStringForRegex(allowed_dir_canonical.value(),
                              &allowed_dir_escaped)) {
       LOG(FATAL) << "Regex string quoting failed " << allowed_dir.value();
       return false;
     }
     NSString* allowed_dir_escaped_ns = base::SysUTF8ToNSString(
         allowed_dir_escaped.c_str());
     sandbox_data = [sandbox_data
         stringByReplacingOccurrencesOfString:@";ENABLE_DIRECTORY_ACCESS"
                                   withString:@""];
     sandbox_data = [sandbox_data
         stringByReplacingOccurrencesOfString:@"DIR_TO_ALLOW_ACCESS"
                                   withString:allowed_dir_escaped_ns];
 
   }
 
-  int32 major_version, minor_version, bugfix_version;
-  base::SysInfo::OperatingSystemVersionNumbers(&major_version,
-      &minor_version, &bugfix_version);
-
-  if (major_version > 10 || (major_version == 10 && minor_version >= 6)) {
+  if (snow_leopard_or_higher) {
     // 10.6-only Sandbox rules.
     sandbox_data = [sandbox_data
         stringByReplacingOccurrencesOfString:@";10.6_ONLY"
                                   withString:@""];
     // Splice the path of the user's home directory into the sandbox profile
     // (see renderer.sb for details).
     // This code is in the 10.6-only block because the sandbox syntax we use
     // for this "subdir" is only supported on 10.6.
     // If we ever need this on pre-10.6 OSs then we'll have to rethink the
     // surrounding sandbox syntax.
@@ skipping 42 matching lines @@
   if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) {
     PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                 << path->value();
     return;
   }
 
   *path = FilePath(canonical_path);
 }
 
 }  // namespace sandbox