Do not double-unref send rights when using POLICY_SUBSTITUE_PORT.

sandbox/mac/launchd_interception_server.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
 #define SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
 
 #include <dispatch/dispatch.h>
 #include <mach/mach.h>
 
@@ skipping 36 matching lines @@
                     mach_msg_header_t* reply,
                     pid_t sender_pid);
 
   // Given a swap_integer request message, this verifies that it is safe, and
   // if so, forwards it on to launchd for servicing. If the request is unsafe,
   // it replies with an error.
   void HandleSwapInteger(mach_msg_header_t* request,
                          mach_msg_header_t* reply,
                          pid_t sender_pid);
 
-  // Sends a reply message.
-  void SendReply(mach_msg_header_t* reply);
+  // Sends a reply message. Returns true if the message was sent successfully.
+  bool SendReply(mach_msg_header_t* reply);
 
   // Forwards the original |request| on to real bootstrap server for handling.
   void ForwardMessage(mach_msg_header_t* request, mach_msg_header_t* reply);
 
   // Replies to the message with the specified |error_code| as a MIG
   // error_reply RetCode.
   void RejectMessage(mach_msg_header_t* request,
                      mach_msg_header_t* reply,
                      int error_code);
 
@@ skipping 12 matching lines @@
   // Request and reply buffers used in ReceiveMessage.
   base::mac::ScopedMachVM request_buffer_;
   base::mac::ScopedMachVM reply_buffer_;
 
   // Whether or not ForwardMessage() was called during ReceiveMessage().
   bool did_forward_message_;
 
   // The Mach port handed out in reply to denied look up requests. All denied
   // requests share the same port, though nothing reads messages from it.
   base::mac::ScopedMachReceiveRight sandbox_port_;
+  // Any sandbox Rules that use the sandbox_port_ will need a send right to
+  // copy.

[Mark Mentovai, 2014/06/02 22:44:15]

This sentence is awkward. “will need a send right to be copied” is maybe a tiny
better. As it is, it kinda sounds like you need a send right to some receiver
named copy.

[Robert Sesek, 2014/06/02 23:28:51]

Done. Reworded to:

"The send right for the above |sandbox_port_|, used with MACH_MSG_TYPE_COPY_SEND
when handing out references to the dummy port."

+  base::mac::ScopedMachSendRight sandbox_send_port_;
 
   // The compatibility shim that handles differences in message header IDs and
   // request/reply structures between different OS X versions.
   const LaunchdCompatibilityShim compat_shim_;
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_