Mac: Tell the GPU sandbox to deny a few things.

chrome/common/sandbox_mac.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_SANDBOX_MAC_H_
 #define CHROME_COMMON_SANDBOX_MAC_H_
 #pragma once
 
 #include <string>
 
@@ skipping 64 matching lines @@
     // Native Client sandbox for the user's untrusted code.
     SANDBOX_TYPE_NACL_LOADER,
 
     // GPU process.
     SANDBOX_TYPE_GPU,
 
     SANDBOX_AFTER_TYPE_LAST_TYPE,  // Placeholder to ease iteration.
   };
 
   // Warm up System APIs that empirically need to be accessed before the Sandbox
   // is turned on.

[jeremy, 2010/12/03 14:22:09]

Can you update the comment with details on the parameter.

[Nico, 2010/12/04 00:26:10]

Done.

-  static void SandboxWarmup();
+  static void SandboxWarmup(SandboxProcessType sandbox_type);
 
   // Turns on the OS X sandbox for this process.
   // |sandbox_type| - type of Sandbox to use.
   // |allowed_dir| - directory to allow access to, currently the only sandbox
   // profile that supports this is SANDBOX_TYPE_UTILITY .
   //
   // Returns true on success, false if an error occurred enabling the sandbox.
   static bool EnableSandbox(SandboxProcessType sandbox_type,
                             const FilePath& allowed_dir);
 
@@ skipping 74 matching lines @@
   FRIEND_TEST(MacDirAccessSandboxTest, StringEscape);
   FRIEND_TEST(MacDirAccessSandboxTest, RegexEscape);
   FRIEND_TEST(MacDirAccessSandboxTest, SandboxAccess);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(Sandbox);
 };
 
 }  // namespace sandbox
 
 #endif  // CHROME_COMMON_SANDBOX_MAC_H_