Mac: Allow accessing various files needed by the defaults system.

chrome/renderer/renderer.sb

 ;;
 ;; Copyright (c) 2009 The Chromium Authors. All rights reserved.
 ;; Use of this source code is governed by a BSD-style license that can be
 ;; found in the LICENSE file.
 ;;
 
 ; *** The contents of chrome/common/common.sb are implicitly included here. ***
 
 ; Needed for Fonts.
 (allow file-read* (regex #"^/System/Library/Fonts($|/)"))  ; 10.5.6
 ; 10.6 for loading fonts in the renderer.
 ; on 10.5 this is needed for the PDF plugin.
 (allow file-read* (regex #"^/Library/Fonts($|/)"))
 (allow mach-lookup (global-name "com.apple.FontObjectsServer"))  ; 10.5.6
 ;10.6_ONLY (allow mach-lookup (global-name "com.apple.FontServer"))  ; 10.6
 
-; http://crbug.com/46648
-(allow file-read* (regex #"^/System/Library/ColorSync($|/)"))  ; 10.5.6
+(allow file-read*
+  (regex #"^/System/Library/ColorSync($|/)")  ; 10.5.6 - http://crbug.com/46648
+  (literal "/Library/Preferences/.GlobalPreferences.plist") ; http://crbug.com/60917
+  (literal "@USER_HOMEDIR_AS_LITERAL@/Library/Preferences/.GlobalPreferences.plist")
+)
 
-; USER_HOMEDIR is substitued at runtime - http://crbug.com/11269
+; http://crbug.com/11269
 ;10.6_ONLY (allow file-read* (subpath "@USER_HOMEDIR_AS_LITERAL@/Library/Fonts"))  ; 10.6
+
+; http://crbug.com/60917
+(allow file-read-metadata
+  (literal "/")
+  (literal "/var")
+)