Allow OpenCL to open libraries in /usr/lib

content/renderer/renderer.sb

 ;;
 ;; Copyright (c) 2011 The Chromium Authors. All rights reserved.
 ;; Use of this source code is governed by a BSD-style license that can be
 ;; found in the LICENSE file.
 ;;
 
 ; *** The contents of content/common/common.sb are implicitly included here. ***
 
 ; Needed for Fonts.
 (allow file-read* (regex #"^/System/Library/Fonts($|/)"))
@@ skipping 18 matching lines @@
 )
 
 ; http://crbug.com/288697
 (allow file-read*
   (regex #"^/(private/)?etc/localtime$")
   (regex #"^/usr/share/zoneinfo/")
 )
 (allow file-read-metadata
   (regex #"^/(private/)?etc$")
 )
+
+; http://crbug.com/508935
+(if (param-true? elcap-or-later)
+  (allow file-read*
+    (literal "/usr/lib/libcsfde.dylib")
+    (regex #"^/usr/lib/libcurl(.4)?.dylib$")

[Robert Sesek, 2015/08/05 22:35:58]

Should you escape the periods here as literals, so they're not treated as
special?

[Greg K, 2015/08/06 00:17:09]

I'm pretty sure that's what the # sign in front of the string does. It's not
really documented though. To make it simpler, I'll just make this a literal as
well. If it tries to open libcurl.dylib at some point, I'll update the sandbox
profile.

+    (literal "/usr/lib/libCoreStorage.dylib")
+    (literal "/usr/lib/libutil.dylib")
+))