Implement the V2 sandbox in the process launcher.

content/common/sandbox_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_mac.h"
 
 #import <Cocoa/Cocoa.h>
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 55 matching lines @@
   { SANDBOX_TYPE_GPU,      IDR_GPU_SANDBOX_PROFILE },
   { SANDBOX_TYPE_PPAPI,    IDR_PPAPI_SANDBOX_PROFILE },
 };
 
 static_assert(arraysize(kDefaultSandboxTypeToResourceIDMapping) == \
               size_t(SANDBOX_TYPE_AFTER_LAST_TYPE), \
               "sandbox type to resource id mapping incorrect");
 
 }  // namespace
 
+// Static variable declarations.
+const char* Sandbox::kSandboxEnableLogging = "ENABLE_LOGGING";
+const char* Sandbox::kSandboxDisableDenialLogging =
+    "DISABLE_SANDBOX_DENIAL_LOGGING";
+const char* Sandbox::kSandboxHomedirAsLiteral = "USER_HOMEDIR_AS_LITERAL";
+const char* Sandbox::kSandboxElCapOrLater = "ELCAP_OR_LATER";
+const char* Sandbox::kSandboxPermittedDir = "PERMITTED_DIR";
+const char* Sandbox::kSandboxBundlePath = "BUNDLE_PATH";
+const char* Sandbox::kSandboxLoggingPathAsLiteral = "LOG_FILE_PATH";
+const char* Sandbox::kSandboxChromeBundleId = "BUNDLE_ID";
+const char* Sandbox::kSandboxComponentPath = "COMPONENT_PATH";
+const char* Sandbox::kSandboxChromePID = "CHROMIUM_PID";
+
 // Warm up System APIs that empirically need to be accessed before the Sandbox
 // is turned on.
 // This method is layed out in blocks, each one containing a separate function
 // that needs to be warmed up. The OS version on which we found the need to
 // enable the function is also noted.
 // This function is tested on the following OS versions:
 //     10.5.6, 10.6.0
 
 // static
 void Sandbox::SandboxWarmup(int sandbox_type) {
@@ skipping 157 matching lines @@
   std::string sandbox_data = LoadSandboxTemplate(sandbox_type);
   if (sandbox_data.empty()) {
     return false;
   }
 
   sandbox::SandboxCompiler compiler(sandbox_data);
 
   if (!allowed_dir.empty()) {
     // Add the sandbox parameters necessary to access the given directory.
     base::FilePath allowed_dir_canonical = GetCanonicalSandboxPath(allowed_dir);
-    if (!compiler.InsertStringParam("PERMITTED_DIR",
+    if (!compiler.InsertStringParam(kSandboxPermittedDir,
                                     allowed_dir_canonical.value()))
       return false;
   }
 
   // Enable verbose logging if enabled on the command line. (See common.sb
   // for details).
   const base::CommandLine* command_line =
       base::CommandLine::ForCurrentProcess();
   bool enable_logging =
       command_line->HasSwitch(switches::kEnableSandboxLogging);;
-  if (!compiler.InsertBooleanParam("ENABLE_LOGGING", enable_logging))
+  if (!compiler.InsertBooleanParam(kSandboxEnableLogging, enable_logging))
     return false;
 
   // Without this, the sandbox will print a message to the system log every
   // time it denies a request.  This floods the console with useless spew.
-  if (!compiler.InsertBooleanParam("DISABLE_SANDBOX_DENIAL_LOGGING",
+  if (!compiler.InsertBooleanParam(kSandboxDisableDenialLogging,
                                    !enable_logging))
     return false;
 
   // Splice the path of the user's home directory into the sandbox profile
   // (see renderer.sb for details).
   std::string home_dir = [NSHomeDirectory() fileSystemRepresentation];
 
   base::FilePath home_dir_canonical =
       GetCanonicalSandboxPath(base::FilePath(home_dir));
 
-  if (!compiler.InsertStringParam("USER_HOMEDIR_AS_LITERAL",
+  if (!compiler.InsertStringParam(kSandboxHomedirAsLiteral,
                                   home_dir_canonical.value()))
     return false;
 
   bool elcap_or_later = base::mac::IsAtLeastOS10_11();
-  if (!compiler.InsertBooleanParam("ELCAP_OR_LATER", elcap_or_later))
+  if (!compiler.InsertBooleanParam(kSandboxElCapOrLater, elcap_or_later))
     return false;
 
   // Initialize sandbox.
   std::string error_str;
   bool success = compiler.CompileAndApplyProfile(&error_str);
   DLOG_IF(FATAL, !success) << "Failed to initialize sandbox: " << error_str;
   gSandboxIsActive = success;
   return success;
 }
 
@@ skipping 15 matching lines @@
   if (HANDLE_EINTR(fcntl(fd.get(), F_GETPATH, canonical_path)) != 0) {
     DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                  << path.value();
     return path;
   }
 
   return base::FilePath(canonical_path);
 }
 
 }  // namespace content