Plumb sandbox rules through the helper executable.

sandbox/mac/seatbelt_exec.h

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_MAC_SEATBELT_EXEC_H_
 #define SANDBOX_MAC_SEATBELT_EXEC_H_
 
 #include <string>
 
 #include "base/compiler_specific.h"
@@ skipping 56 matching lines @@
   ~SeatbeltExecServer();
 
   // Reads the policy from the client, applies the profile, and returns whether
   // or not the operation succeeds.
   bool InitializeSandbox();
 
   // Applies the given sandbox policy, and returns whether or not the operation
   // succeeds.
   bool ApplySandboxProfile(const mac::SandboxPolicy& sandbox_policy);
 
+  // Set a string parameter in the sandbox profile. This is present in the
+  // server because the process about to initialize a sandbox may need to add
+  // some extra parameters, such as the path to the executable or the current
+  // PID. This must be called before InitializeSandbox().
+  bool SetParameter(const base::StringPiece key,
+                    const base::StringPiece value) WARN_UNUSED_RESULT;
+
  private:
   // Reads from the |fd_| and stores the data into a string. This does
   // not append a NUL terminator as protobuf does not expect one.
   bool ReadString(std::string* string);
 
   // The file descriptor used to communicate with the launcher process.
   base::ScopedFD fd_;
+
+  // Extra parameters added by the server process.
+  std::map<std::string, std::string> extra_params_;
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_MAC_SEATBELT_EXEC_H_