mac: Make the (10.6-only) sandbox hole for the components build smaller

content/common/sandbox_mac.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_SANDBOX_MAC_H_
 #define CONTENT_COMMON_SANDBOX_MAC_H_
 #pragma once
 
 #include <string>
 
@@ skipping 107 matching lines @@
   //
   // On output |final_sandbox_profile_str| contains the final sandbox profile.
   // Returns true on success, false otherwise.
   static bool PostProcessSandboxProfile(
                   NSString* in_sandbox_data,
                   NSArray* comments_to_remove,
                   SandboxVariableSubstitions& substitutions,
                   std::string *final_sandbox_profile_str);
 
  private:
+  // Returns an (allow file-read-metadata) rule for |allowed_path| and all its
+  // parent directories.
+  static NSString* AllowMetadataForPath(const FilePath& allowed_path);
+
   // Escape |src_utf8| for use in a plain string variable in a sandbox
   // configuraton file.  On return |dst| is set to the quoted output.
   // Returns: true on success, false otherwise.
   static bool QuotePlainString(const std::string& src_utf8, std::string* dst);
 
   // Escape |str_utf8| for use in a regex literal in a sandbox
   // configuraton file.  On return |dst| is set to the utf-8 encoded quoted
   // output.
   //
   // The implementation of this function is based on empirical testing of the
   // OS X sandbox on 10.5.8 & 10.6.2 which is undocumented and subject to
   // change.
   //
   // Note: If str_utf8 contains any characters < 32 || >125 then the function
   // fails and false is returned.
   //
   // Returns: true on success, false otherwise.
   static bool QuoteStringForRegex(const std::string& str_utf8,
                                   std::string* dst);
 
   // Convert provided path into a "canonical" path matching what the Sandbox
   // expects i.e. one without symlinks.
   // This path is not necessarily unique e.g. in the face of hardlinks.
-  static void GetCanonicalSandboxPath(FilePath* path);
+  static FilePath GetCanonicalSandboxPath(const FilePath& path);
 
   FRIEND_TEST_ALL_PREFIXES(MacDirAccessSandboxTest, StringEscape);
   FRIEND_TEST_ALL_PREFIXES(MacDirAccessSandboxTest, RegexEscape);
   FRIEND_TEST_ALL_PREFIXES(MacDirAccessSandboxTest, SandboxAccess);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(Sandbox);
 };
 
 }  // namespace sandbox
 
 #endif  // CONTENT_COMMON_SANDBOX_MAC_H_