Plumb sandbox rules through the helper executable.

sandbox/mac/sandbox_mac_seatbelt_exec_unittest.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/seatbelt_exec.h"
 
 #include "base/process/kill.h"
 #include "base/test/multiprocess_test.h"
 #include "base/test/test_timeouts.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ skipping 13 matching lines @@
       "(allow file-read* (literal (param executable-path)))\n"
       "(allow file-read* (subpath (param allowed-dir)))\n";
 
   SeatbeltExecServer exec_server(-1);
   std::string exec_path = "/bin/ls";
   std::string allowed_path = "/Applications";
 
   mac::SandboxPolicy policy;
   google::protobuf::MapPair<std::string, std::string> allowed_pair(
       "ALLOWED_READ_DIR", allowed_path);
-  google::protobuf::MapPair<std::string, std::string> exec_pair(
-      "EXECUTABLE_PATH", exec_path);
   CHECK(policy.mutable_params()->insert(allowed_pair).second);
-  CHECK(policy.mutable_params()->insert(exec_pair).second);
   policy.set_profile(profile);
 
+  CHECK(exec_server.SetParameter("EXECUTABLE_PATH", exec_path));
   CHECK(exec_server.ApplySandboxProfile(policy));
 
   // Test that the sandbox profile is actually applied.
   struct stat sb;
   CHECK_EQ(0, stat(allowed_path.c_str(), &sb));
   CHECK_EQ(-1, stat("/", &sb));
   CHECK_EQ(0, stat(exec_path.c_str(), &sb));
 
   return 0;
 }
@@ skipping 27 matching lines @@
 TEST_F(SeatbeltExecTest, ClientTest) {
   base::SpawnChildResult spawn_child = SpawnChild("ClientTest");
   ASSERT_TRUE(spawn_child.process.IsValid());
   int exit_code = 42;
   EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout(
       TestTimeouts::action_max_timeout(), &exit_code));
   EXPECT_EQ(exit_code, 0);
 }
 
 }  // namespace sandbox