services/shell: Turn on sandboxing for mojo apps.

services/shell/service_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "services/shell/service_manager.h"
 
 #include <stdint.h>
 
 #include <utility>
 
@@ skipping 200 matching lines @@
   void StartWithClientProcessConnection(
       mojom::ClientProcessConnectionPtr client_process_connection) {
     mojom::ServicePtr service;
     service.Bind(mojom::ServicePtrInfo(
         std::move(client_process_connection->service), 0));
     pid_receiver_binding_.Bind(
         std::move(client_process_connection->pid_receiver_request));
     StartWithService(std::move(service));
   }
 
-  void StartWithFilePath(const base::FilePath& path) {
+  void StartWithFilePath(const base::FilePath& path, bool privileged) {
     CHECK(!service_);
     runner_ = service_manager_->native_runner_factory_->Create(path);
-    bool start_sandboxed = false;
+    bool start_sandboxed = !privileged;
     mojom::ServicePtr service = runner_->Start(
         path, identity_, start_sandboxed,
         base::Bind(&Instance::PIDAvailable, weak_factory_.GetWeakPtr()),
         base::Bind(&Instance::OnRunnerCompleted, weak_factory_.GetWeakPtr()));
     StartWithService(std::move(service));
   }
 
   mojom::ServiceInfoPtr CreateServiceInfo() const {
     mojom::ServiceInfoPtr info(mojom::ServiceInfo::New());
     info->id = id_;
@@ skipping 576 matching lines @@
     // Otherwise we create a new Service pipe.
     mojom::ServiceRequest request = GetProxy(&service);
     CHECK(!result->package_path.empty() && result->capabilities.has_value());
 
     if (target.name() != result->resolved_name) {
       instance->StartWithService(std::move(service));
       Identity factory(result->resolved_name, target.user_id(),
                        instance_name);
       CreateServiceWithFactory(factory, target.name(), std::move(request));
     } else {
-      instance->StartWithFilePath(result->package_path);
+      instance->StartWithFilePath(result->package_path, result->privileged);
     }
   }
 
   // Now that the instance has a Service, we can connect to it.
   bool connected = instance->ConnectToService(&params);
   DCHECK(connected);
 }
 
 base::WeakPtr<ServiceManager> ServiceManager::GetWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
 
 }  // namespace shell