Mac: Fix WebGL in OS X 10.7 + misc. Sandbox cleanup

content/common/sandbox_mac.mm

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_mac.h"
 
 #import <Cocoa/Cocoa.h>
 #import <OpenGL/OpenGL.h>
 
 extern "C" {
@@ skipping 367 matching lines @@
     LOG(FATAL) << "Failed to find the sandbox profile on disk "
                << [sandbox_profile_path fileSystemRepresentation];
     return nil;
   }
 
   // Prefix sandbox_data with common_sandbox_prefix_data.
   return [common_sandbox_prefix_data stringByAppendingString:sandbox_data];
 }
 
 // Retrieve OS X version, output parameters are self explanatory.
-void GetOSVersion(bool* snow_leopard_or_higher) {
+void GetOSVersion(bool* snow_leopard_or_higher, bool* lion_or_higher) {
   int32 major_version, minor_version, bugfix_version;
   base::SysInfo::OperatingSystemVersionNumbers(&major_version,
                                                &minor_version,
                                                &bugfix_version);
   *snow_leopard_or_higher =
       (major_version > 10 || (major_version == 10 && minor_version >= 6));
+  *lion_or_higher =
+      (major_version > 10 || (major_version == 10 && minor_version >= 7));
 }
 
 // static
 bool Sandbox::PostProcessSandboxProfile(
         NSString* sandbox_template,
         NSArray* comments_to_remove,
         SandboxVariableSubstitions& substitutions,
         std::string *final_sandbox_profile_str) {
   NSString* sandbox_data = [[sandbox_template copy] autorelease];
 
@@ skipping 93 matching lines @@
   // Enable verbose logging if enabled on the command line. (See common.sb
   // for details).
   const CommandLine* command_line = CommandLine::ForCurrentProcess();
   bool enable_logging =
       command_line->HasSwitch(switches::kEnableSandboxLogging);;
   if (enable_logging) {
     [tokens_to_remove addObject:@";ENABLE_LOGGING"];
   }
 
   bool snow_leopard_or_higher;
-  GetOSVersion(&snow_leopard_or_higher);
+  bool lion_or_higher;
+  GetOSVersion(&snow_leopard_or_higher, &lion_or_higher);
 
   // Without this, the sandbox will print a message to the system log every
   // time it denies a request.  This floods the console with useless spew. The
   // (with no-log) syntax is only supported on 10.6+
   if (snow_leopard_or_higher && !enable_logging) {
     substitutions["DISABLE_SANDBOX_DENIAL_LOGGING"] =
         SandboxSubstring("(with no-log)");
   } else {
     substitutions["DISABLE_SANDBOX_DENIAL_LOGGING"] = SandboxSubstring("");
   }
 
   // Splice the path of the user's home directory into the sandbox profile
   // (see renderer.sb for details).
   std::string home_dir = base::SysNSStringToUTF8(NSHomeDirectory());
 
   FilePath home_dir_canonical(home_dir);
   GetCanonicalSandboxPath(&home_dir_canonical);
 
   substitutions["USER_HOMEDIR_AS_LITERAL"] =
       SandboxSubstring(home_dir_canonical.value(),
           SandboxSubstring::LITERAL);
 
+  if (lion_or_higher) {
+    // >=10.7 Sandbox rules.
+    [tokens_to_remove addObject:@";10.7_OR_ABOVE"];
+  }

[Nico, 2011/05/22 16:01:06]

|else [tokens_to_remove addObject:@";BEFORE_10.7"];| for symmetry?

+
   if (snow_leopard_or_higher) {
-    // 10.6-only Sandbox rules.
-    [tokens_to_remove addObject:@";10.6_ONLY"];
+    // >=10.6 Sandbox rules.
+    [tokens_to_remove addObject:@";10.6_OR_ABOVE"];
   } else {
     // Sandbox rules only for versions before 10.6.
     [tokens_to_remove addObject:@";BEFORE_10.6"];
   }
 
   // All information needed to assemble the final profile has been collected.
   // Merge it all together.
   std::string final_sandbox_profile_str;
   if (!PostProcessSandboxProfile(sandbox_data, tokens_to_remove, substitutions,
                                  &final_sandbox_profile_str)) {
@@ skipping 26 matching lines @@
   if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) {
     PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                 << path->value();
     return;
   }
 
   *path = FilePath(canonical_path);
 }
 
 }  // namespace sandbox