Plumb sandbox rules through the helper executable.

sandbox/mac/seatbelt_exec.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/seatbelt_exec.h"
 
 #include <sys/socket.h>
 #include <sys/uio.h>
 #include <unistd.h>
 
@@ skipping 57 matching lines @@
   iov[0].iov_len = str->size();
 
   ssize_t written = HANDLE_EINTR(writev(pipe_[1], iov, arraysize(iov)));
   if (written < 0) {
     PLOG(ERROR) << "writev";
     return false;
   }
   return static_cast<uint64_t>(written) == str->size();
 }
 
-SeatbeltExecServer::SeatbeltExecServer(int fd) : fd_(fd) {}
+SeatbeltExecServer::SeatbeltExecServer(int fd) : fd_(fd), extra_params_() {}
 
 SeatbeltExecServer::~SeatbeltExecServer() {}
 
 bool SeatbeltExecServer::InitializeSandbox() {
   std::string policy_string;
   if (!ReadString(&policy_string))
     return false;
 
   mac::SandboxPolicy policy;
   if (!policy.ParseFromString(policy_string)) {
     LOG(ERROR) << "ParseFromString failed";
     return false;
   }
 
   return ApplySandboxProfile(policy);
 }
 
 bool SeatbeltExecServer::ApplySandboxProfile(const mac::SandboxPolicy& policy) {
   std::vector<const char*> weak_params;
   for (const auto& pair : policy.params()) {
     weak_params.push_back(pair.first.c_str());
     weak_params.push_back(pair.second.c_str());
   }
+  for (const auto& pair : extra_params_) {
+    weak_params.push_back(pair.first.c_str());
+    weak_params.push_back(pair.second.c_str());
+  }
   weak_params.push_back(nullptr);
 
   char* error = nullptr;
   int rv = Seatbelt::InitWithParams(policy.profile().c_str(), 0,
                                     weak_params.data(), &error);
   if (error) {
     LOG(ERROR) << "Failed to initialize sandbox: " << rv << " " << error;
     Seatbelt::FreeError(error);
     return false;
   }
@@ skipping 11 matching lines @@
 
   ssize_t read_length = HANDLE_EINTR(readv(fd_.get(), iov, arraysize(iov)));
   if (read_length < 0) {
     PLOG(ERROR) << "readv";
     return false;
   }
   str->assign(buffer.data());
   return true;
 }
 
+bool SeatbeltExecServer::SetParameter(const base::StringPiece key,
+                                      const base::StringPiece value) {
+  return extra_params_
+      .insert(std::make_pair(key.as_string(), value.as_string()))
+      .second;
+}
+
 }  // namespace sandbox