Support DirectWrite with sandbox on

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
@@ skipping 624 matching lines @@
     delegate->PreSandbox(&disable_default_policy, &exposed_dir);
 
   if (!disable_default_policy && !AddPolicyForSandboxedProcess(policy))
     return 0;
 
   if (type_str != switches::kRendererProcess) {
     // Hack for Google Desktop crash. Trick GD into not injecting its DLL into
     // this subprocess. See
     // http://code.google.com/p/chromium/issues/detail?id=25580
     cmd_line->AppendSwitchASCII("ignored", " --type=renderer ");
+  } else {
+    AddDirectory(base::DIR_WINDOWS_FONTS,

[jschuh, 2014/03/25 04:03:48]

This should be scoped to only when DW is enabled.

+                NULL,
+                true,
+                sandbox::TargetPolicy::FILES_ALLOW_READONLY,
+                policy);
   }
 
   sandbox::ResultCode result;
   if (!exposed_dir.empty()) {
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
                              sandbox::TargetPolicy::FILES_ALLOW_ANY,
                              exposed_dir.value().c_str());
     if (result != sandbox::SBOX_ALL_OK)
       return 0;
 
@@ skipping 89 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content