| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/bootstrap_sandbox_manager_mac.h" | 5 #include "content/browser/bootstrap_sandbox_manager_mac.h" |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "base/mac/mac_util.h" | 8 #include "base/mac/mac_util.h" |
| 9 #include "content/browser/mach_broker_mac.h" | 9 #include "content/browser/mach_broker_mac.h" |
| 10 #include "content/common/sandbox_init_mac.h" | 10 #include "content/common/sandbox_init_mac.h" |
| (...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 73 sandbox::Rule(sandbox::POLICY_ALLOW); | 73 sandbox::Rule(sandbox::POLICY_ALLOW); |
| 74 | 74 |
| 75 // Allow access to the windowserver. This is needed to get the colorspace | 75 // Allow access to the windowserver. This is needed to get the colorspace |
| 76 // during sandbox warmup. Since NSColorSpace conforms to NSCoding, this | 76 // during sandbox warmup. Since NSColorSpace conforms to NSCoding, this |
| 77 // should be plumbed over IPC instead <http://crbug.com/265709>. | 77 // should be plumbed over IPC instead <http://crbug.com/265709>. |
| 78 policy.rules["com.apple.windowserver.active"] = | 78 policy.rules["com.apple.windowserver.active"] = |
| 79 sandbox::Rule(sandbox::POLICY_ALLOW); | 79 sandbox::Rule(sandbox::POLICY_ALLOW); |
| 80 | 80 |
| 81 // Allow access to launchservicesd on 10.10+ otherwise the renderer will crash | 81 // Allow access to launchservicesd on 10.10+ otherwise the renderer will crash |
| 82 // attempting to get its ASN. http://crbug.com/533537 | 82 // attempting to get its ASN. http://crbug.com/533537 |
| 83 if (base::mac::IsOSYosemiteOrLater()) { | 83 if (base::mac::IsAtLeastOS10_10()) { |
| 84 policy.rules["com.apple.coreservices.launchservicesd"] = | 84 policy.rules["com.apple.coreservices.launchservicesd"] = |
| 85 sandbox::Rule(sandbox::POLICY_ALLOW); | 85 sandbox::Rule(sandbox::POLICY_ALLOW); |
| 86 } | 86 } |
| 87 | 87 |
| 88 sandbox_->RegisterSandboxPolicy(SANDBOX_TYPE_RENDERER, policy); | 88 sandbox_->RegisterSandboxPolicy(SANDBOX_TYPE_RENDERER, policy); |
| 89 } | 89 } |
| 90 | 90 |
| 91 void BootstrapSandboxManager::AddBaselinePolicy( | 91 void BootstrapSandboxManager::AddBaselinePolicy( |
| 92 sandbox::BootstrapSandboxPolicy* policy) { | 92 sandbox::BootstrapSandboxPolicy* policy) { |
| 93 auto& rules = policy->rules; | 93 auto& rules = policy->rules; |
| 94 | 94 |
| 95 // Allow the child to send its task port to the MachBroker. | 95 // Allow the child to send its task port to the MachBroker. |
| 96 rules[MachBroker::GetMachPortName()] = sandbox::Rule(sandbox::POLICY_ALLOW); | 96 rules[MachBroker::GetMachPortName()] = sandbox::Rule(sandbox::POLICY_ALLOW); |
| 97 | 97 |
| 98 // Allow logging to the syslog. | 98 // Allow logging to the syslog. |
| 99 rules["com.apple.system.logger"] = sandbox::Rule(sandbox::POLICY_ALLOW); | 99 rules["com.apple.system.logger"] = sandbox::Rule(sandbox::POLICY_ALLOW); |
| 100 } | 100 } |
| 101 | 101 |
| 102 } // namespace content | 102 } // namespace content |
| OLD | NEW |