Initial implementation of the Mac Bootstrap Sandbox.

sandbox/mac/policy.cc

Index: sandbox/mac/policy.cc
diff --git a/sandbox/mac/policy.cc b/sandbox/mac/policy.cc
new file mode 100644
index 0000000000000000000000000000000000000000..8d838b1871cc23d71d9bfab90a80340dcebdd1b1
--- /dev/null
+++ b/sandbox/mac/policy.cc
@@ -0,0 +1,53 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/mac/policy.h"
+
+namespace sandbox {
+
+Rule::Rule()
+    : result(POLICY_DECISION_INVALID),
+      substitute_port(MACH_PORT_NULL) {
+}
+
+Rule::Rule(PolicyDecision result)
+    : result(result),
+      substitute_port(MACH_PORT_NULL) {
+}
+
+Rule::Rule(mach_port_t override_port)
+    : result(POLICY_SUBSTITUE_PORT),
+      substitute_port(override_port) {
+}
+
+Rule::Rule(const Rule& other) {
+  *this = other;
+}
+
+void Rule::operator=(const Rule& other) {
+  result = other.result;

[Mark Mentovai, 2014/05/06 20:51:50]

Did the “*this = other” form work in the constructor but not in operator=?

[Robert Sesek, 2014/05/08 20:58:12]

Actually removed both because this is a struct.

+  substitute_port = other.substitute_port;
+}
+
+bool IsPolicyValid(const BootstrapSandboxPolicy& policy) {
+  for (BootstrapSandboxPolicy::const_iterator it = policy.begin();
+       it != policy.end();
+       ++it) {
+    const Rule& rule = it->second;
+    if (!(rule.result > POLICY_DECISION_INVALID &&
+          rule.result < POLICY_DECISION_LAST)) {
+      return false;
+    }
+    if (rule.result == POLICY_SUBSTITUE_PORT) {
+      if (rule.substitute_port == MACH_PORT_NULL)
+        return false;
+    } else {
+      if (rule.substitute_port != MACH_PORT_NULL)
+        return false;
+    }
+  }
+  return true;
+}
+
+}  // namespace sandbox