Plumb sandbox rules through the helper executable.

chrome/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/chrome_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/compiler/pgo/pgo.gni")
 import("//build/config/features.gni")
 import("//build/config/locales.gni")
 import("//build/config/sanitizers/sanitizers.gni")
@@ skipping 728 matching lines @@
       "app/chrome_exe_main_mac.cc",
     ]
 
     extra_configs = [ "//build/config/compiler:wexit_time_destructors" ]
 
     defines = [ "HELPER_EXECUTABLE" ]
 
     deps = [
       "//build/config:exe_and_shlib_deps",
       "//chrome/common:version_header",
+      "//sandbox/mac:seatbelt",
     ]
 
     ldflags = []
 
     if (is_component_build) {
       ldflags += [
         # The helper is in Chromium.app/Contents/Versions/X/Chromium Helper.app/Conents/MacOS/
         # so set rpath up to the base.
         "-rpath",
         "@loader_path/../../../../../../..",
@@ skipping 1009 matching lines @@
       "//chrome/app/theme/$branding_path_component/product_logo_48.png",
       "//chrome/tools/build/linux/chrome-wrapper",
       "//third_party/xdg-utils/scripts/xdg-mime",
       "//third_party/xdg-utils/scripts/xdg-settings",
     ]
     outputs = [
       "$root_out_dir/{{source_file_part}}",
     ]
   }
 }