Initialize the bootstrap sandbox in the browser process.

content/public/common/sandboxed_process_launcher_delegate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_
 #define CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_
 
 #include "base/environment.h"
 #include "base/process/process.h"
 
@@ skipping 44 matching lines @@
 #elif defined(OS_POSIX)
   // Override this to return true to use the setuid sandbox.
   virtual bool ShouldUseZygote();
 
   // Override this if the process needs a non-empty environment map.
   virtual base::EnvironmentMap GetEnvironment();
 
   // Return the file descriptor for the IPC channel.
   virtual int GetIpcFd() = 0;
 
+#if defined(OS_MACOSX)
+  // Gets the Mac SandboxType to enforce on the process. Return -1 for no

[Mark Mentovai, 2014/05/30 21:01:13]

What’s a SandboxType? It’s just a registered policy ID, right? You should say
more about this in the comment, because the return value is just “int” and
SandboxType isn’t actually a thing. Implementers will need to know what to do
here.

Maybe the type returned here should be a typedef, like SandboxPolicyID? You
wouldn’t have to say as much in this comment here then.

[Robert Sesek, 2014/05/30 21:05:11]

Yes, it is:

https://code.google.com/p/chromium/codesearch#chromium/src/content/public/com...

[jam, 2014/05/30 21:11:55]

can this be SandboxType instead of "int" then?

[Robert Sesek, 2014/05/30 21:17:35]

Yeah, if I add an INVALID enum value. Done.

+  // sandbox policy.
+  virtual int GetSandboxType();
+#endif
+
 #endif
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_