Plumb sandbox rules through the helper executable.

chrome/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/chrome_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/compiler/pgo/pgo.gni")
 import("//build/config/features.gni")
 import("//build/config/locales.gni")
 import("//build/config/sanitizers/sanitizers.gni")
@@ skipping 531 matching lines @@
     output_name = chrome_product_full_name
 
     info_plist_target = ":chrome_app_plist"
     extra_substitutions = [
       "CHROMIUM_BUNDLE_ID=$chrome_mac_bundle_id",
       "CHROMIUM_SHORT_NAME=$chrome_product_short_name",
       "CHROMIUM_CREATOR=$chrome_mac_creator_code",
     ]
 
     sources = [
-      "app/chrome_exe_main_mac.c",
+      "app/chrome_exe_main_mac.cc",
     ]
 
     extra_configs = [ "//build/config/compiler:wexit_time_destructors" ]
 
     deps = [
       ":chrome_app_strings_bundle_data",
       ":chrome_resources",
       ":chrome_versioned_bundle_data",
       "//build/config/sanitizers:deps",
       "//chrome/common:version_header",
@@ skipping 166 matching lines @@
   mac_app_bundle("chrome_helper_app") {
     output_name = chrome_helper_name
 
     info_plist_target = ":chrome_helper_plist"
     extra_substitutions = [
       "CHROMIUM_BUNDLE_ID=$chrome_mac_bundle_id",
       "CHROMIUM_SHORT_NAME=$chrome_product_short_name",
     ]
 
     sources = [
-      "app/chrome_exe_main_mac.c",
+      "app/chrome_exe_main_mac.cc",
     ]
 
     extra_configs = [ "//build/config/compiler:wexit_time_destructors" ]
 
     defines = [ "HELPER_EXECUTABLE" ]
 
     deps = [
       "//build/config/sanitizers:deps",
       "//chrome/common:version_header",
+      "//sandbox/mac:seatbelt",
     ]
 
     ldflags = []
 
     if (is_component_build) {
       ldflags += [
         # The helper is in Chromium.app/Contents/Versions/X/Chromium Helper.app/Conents/MacOS/
         # so set rpath up to the base.
         "-rpath",
         "@loader_path/../../../../../../..",
@@ skipping 1009 matching lines @@
       "//chrome/app/theme/$branding_path_component/product_logo_48.png",
       "//chrome/tools/build/linux/chrome-wrapper",
       "//third_party/xdg-utils/scripts/xdg-mime",
       "//third_party/xdg-utils/scripts/xdg-settings",
     ]
     outputs = [
       "$root_out_dir/{{source_file_part}}",
     ]
   }
 }