Sandbox Worker process on the Mac.

chrome/browser/utility_process_host.cc

Index: chrome/browser/utility_process_host.cc
diff --git a/chrome/browser/utility_process_host.cc b/chrome/browser/utility_process_host.cc
index 0ba763bea44b97d8ffd39ad8d43c49a9691947cb..fd6f98571d9e11cfee724f634958f44e2ba0ed0b 100644
--- a/chrome/browser/utility_process_host.cc
+++ b/chrome/browser/utility_process_host.cc
@@ -67,8 +67,8 @@ FilePath UtilityProcessHost::GetUtilityProcessCmd() {
 
 bool UtilityProcessHost::StartProcess(const FilePath& exposed_dir) {
 #if defined(OS_POSIX)
-  // TODO(port): We should not reach here on linux (crbug.com/22703) or
-  // MacOS (crbug.com/8102) until problems related to autoupdate are fixed.
+  // TODO(port): We should not reach here on Linux (crbug.com/22703).
+  // (crbug.com/23837) covers enabling this on Linux/OS X.
   NOTREACHED();
   return false;
 #endif
@@ -108,7 +108,7 @@ bool UtilityProcessHost::StartProcess(const FilePath& exposed_dir) {
     process = sandbox::StartProcessWithAccess(&cmd_line, exposed_dir);
   }
 #else
-  // TODO(port): Sandbox this on Linux/Mac.  Also, zygote this to work with
+  // TODO(port): Sandbox this on Linux.  Also, zygote this to work with
   // Linux updating.
   const CommandLine& browser_command_line = *CommandLine::ForCurrentProcess();
   bool has_cmd_prefix = browser_command_line.HasSwitch(
@@ -120,6 +120,9 @@ bool UtilityProcessHost::StartProcess(const FilePath& exposed_dir) {
         switches::kUtilityCmdPrefix));
   }
 
+  cmd_line.AppendSwitchWithValue(switches::kUtilityProcessAllowedDir,
+                                 exposed_dir.value().c_str());
+
   // This code is duplicated with browser_render_process_host.cc and
   // plugin_process_host.cc, but there's not a good place to de-duplicate it.
   // Maybe we can merge this into sandbox::StartProcess which will set up