services/shell: Turn on sandboxing for mojo apps.

chrome/app/mash/mash_runner.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/app/mash/mash_runner.h"
 
 #include "base/at_exit.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 55 matching lines @@
   void AdjustCommandLineArgumentsForTarget(
       const shell::Identity& target,
       base::CommandLine* command_line) override {
     if (target.name() != "exe:chrome") {
       if (target.name() == "exe:chrome_mash")
         ChangeChromeMashToChrome(command_line);
       command_line->AppendSwitchASCII(switches::kProcessType, kMashChild);
 #if defined(OS_WIN)
       command_line->AppendArg(switches::kPrefetchArgumentOther);
 #endif
+      if (target.instance() == "font_service" || target.instance() == "ui") {
+        base::CommandLine::StringVector argv(command_line->argv());
+        auto iter =
+            std::find(argv.begin(), argv.end(),
+                      FILE_PATH_LITERAL("--enable-sandbox"));
+        if (iter != argv.end())
+          argv.erase(iter);
+        *command_line = base::CommandLine(argv);
+      }
       return;
     }
 
     base::CommandLine::StringVector argv(command_line->argv());
     auto iter =
         std::find(argv.begin(), argv.end(), FILE_PATH_LITERAL("--mash"));
     if (iter != argv.end())
       argv.erase(iter);
     *command_line = base::CommandLine(argv);
   }
@@ skipping 76 matching lines @@
         tracing::GetConfigForTraceToConsole();
     base::trace_event::TraceLog::GetInstance()->SetEnabled(
         trace_config,
         base::trace_event::TraceLog::RECORDING_MODE);
   }
 
   MashRunner mash_runner;
   mash_runner.Run();
   return 0;
 }