Mac: block ability to stat arbitrary files in the Sandbox

chrome/renderer/renderer.sb

Index: chrome/renderer/renderer.sb
diff --git a/chrome/renderer/renderer.sb b/chrome/renderer/renderer.sb
index 9c075b4318fcc2d14d68d66f2b90a4348dbc00bc..ffd1052590dcc0af182ed0c02f0173ca07079687 100644
--- a/chrome/renderer/renderer.sb
+++ b/chrome/renderer/renderer.sb
@@ -7,15 +7,15 @@
 ; *** The contents of chrome/common/common.sb are implicitly included here. ***
 
 ; Needed for Fonts.
-(allow file-read-data (regex #"^/System/Library/Fonts($|/)"))  ; 10.5.6
+(allow file-read* (regex #"^/System/Library/Fonts($|/)"))  ; 10.5.6
 ; 10.6 for loading fonts in the renderer.
 ; on 10.5 this is needed for the PDF plugin.
-(allow file-read-data (regex #"^/Library/Fonts($|/)"))
+(allow file-read* (regex #"^/Library/Fonts($|/)"))
 (allow mach-lookup (global-name "com.apple.FontObjectsServer"))  ; 10.5.6
 ;10.6_ONLY (allow mach-lookup (global-name "com.apple.FontServer"))  ; 10.6
 
 ; http://crbug.com/46648
-(allow file-read-data (regex #"^/System/Library/ColorSync($|/)"))  ; 10.5.6
+(allow file-read* (regex #"^/System/Library/ColorSync($|/)"))  ; 10.5.6
 
 ; USER_HOMEDIR is substitued at runtime - http://crbug.com/11269
-;10.6_ONLY (allow file-read-data (subpath "USER_HOMEDIR/Library/Fonts"))  ; 10.6
+;10.6_ONLY (allow file-read* (subpath "USER_HOMEDIR/Library/Fonts"))  ; 10.6