Add the MacSandboxTest.NSSAccess test to content_unittests.

Add the MacSandboxTest.NSSAccess test to content_unittests.

Allow sandboxed processes to call stat() on /dev/urandom because NSS does
that during initialization.

R=rsleevi@chromium.org,jeremy@chromium.org,shess@chromium.org
BUG=244661
TEST=content_unittests --gtest_filter=MacSandboxTest.NSSAccess

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=205666

[wtc, 2013-06-10 18:57:53]

https://codereview.chromium.org/16748002/diff/1/content/common/common.sb
File content/common/common.sb (right):

https://codereview.chromium.org/16748002/diff/1/content/common/common.sb#newc...
content/common/common.sb:40: (allow file-read-data file-read-metadata (literal
"/dev/urandom"))

The file-read-metadata permission for /dev/urandom is needed for NSS
to call stat("/dev/urandom") successfully.

I can patch NSS to not do that. See the second change to unix_rand.c
in patch set 1 of https://codereview.chromium.org/15990009

But I think it's better to just allow file-read-metadata for
"/dev/urandom". I'd like to hear your opinions. Thanks.

[Scott Hess - ex-Googler, 2013-06-10 19:17:16]

On 2013/06/10 18:57:53, wtc wrote:
> But I think it's better to just allow file-read-metadata for
> "/dev/urandom". I'd like to hear your opinions. Thanks.

LGTM, I'm not sure how you could productively leverage anything out of this. 
The only time the metadata is going to differ from a standard install is if
someone has messed with their system.

[I suppose could someone use this as a way to test an exploit which can allow
filesystem modification?  file-read* on the /System/Library subdirs would
suffice for that.]

[jeremy, 2013-06-11 08:56:32]

LGTM but seconding shess@'s comment - do we really need this?

[wtc, 2013-06-11 15:37:15]

On 2013/06/11 08:56:32, jeremy wrote:
> LGTM but seconding shess@'s comment - do we really need this?

We don't really need this. But I can explain why NSS does this.

The NSS function that calls stat() on /dev/urandom is also used
to read from some other files as entropy sources:

http://mxr.mozilla.org/nss/ident?i=RNG_FileUpdate
http://mxr.mozilla.org/nss/ident?i=RNG_FileForRNG

(RNG_FileForRNG is a simple wrapper around RNG_FileUpdate.)

The contents of the stat buffer may vary for those files (such
as the file size and the creation and last modified times).

[commit-bot: I haz the power, 2013-06-11 15:38:37]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/wtc@chromium.org/16748002/1

[commit-bot: I haz the power, 2013-06-11 22:53:16]

Change committed as 205666