Allow OpenCL to open libraries in /usr/lib

content/renderer/renderer.sb

Index: content/renderer/renderer.sb
diff --git a/content/renderer/renderer.sb b/content/renderer/renderer.sb
index d27f650bdf89e9542d39f856bca42ae7874de5f3..d1daf8e5a883baab52603911a38bfd83384bdfae 100644
--- a/content/renderer/renderer.sb
+++ b/content/renderer/renderer.sb
@@ -36,3 +36,12 @@
 (allow file-read-metadata
   (regex #"^/(private/)?etc$")
 )
+
+; http://crbug.com/508935
+(if (param-true? elcap-or-later)
+  (allow file-read*
+    (literal "/usr/lib/libcsfde.dylib")
+    (regex #"^/usr/lib/libcurl(.4)?.dylib$")

[Robert Sesek, 2015/08/05 22:35:58]

Should you escape the periods here as literals, so they're not treated as
special?

[Greg K, 2015/08/06 00:17:09]

I'm pretty sure that's what the # sign in front of the string does. It's not
really documented though. To make it simpler, I'll just make this a literal as
well. If it tries to open libcurl.dylib at some point, I'll update the sandbox
profile.

+    (literal "/usr/lib/libCoreStorage.dylib")
+    (literal "/usr/lib/libutil.dylib")
+))