Make BootstrapSandboxPolicy a struct, containing the existing rule map and a new default rule.

sandbox/mac/launchd_interception_server.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/launchd_interception_server.h"
 
 #include <bsm/libbsm.h>
 #include <servers/bootstrap.h>
 
 #include "base/logging.h"
@@ skipping 173 matching lines @@
 void LaunchdInterceptionServer::HandleLookUp(mach_msg_header_t* request,
                                              mach_msg_header_t* reply,
                                              pid_t sender_pid) {
   const std::string request_service_name(
       compat_shim_.look_up2_get_request_name(request));
   VLOG(2) << "Incoming look_up2 request for " << request_service_name;
 
   // Find the Rule for this service. If one is not found, use
   // a safe default, POLICY_DENY_ERROR.
   const BootstrapSandboxPolicy* policy = sandbox_->PolicyForProcess(sender_pid);
-  const BootstrapSandboxPolicy::const_iterator it =
-      policy->find(request_service_name);
-  Rule rule(POLICY_DENY_ERROR);
-  if (it != policy->end())
+  const BootstrapSandboxPolicy::NamedRules::const_iterator it =
+      policy->rules.find(request_service_name);
+  Rule rule(policy->default_rule);
+  if (it != policy->rules.end())
     rule = it->second;
 
   if (rule.result == POLICY_ALLOW) {
     // This service is explicitly allowed, so this message will not be
     // intercepted by the sandbox.
     VLOG(1) << "Permitting and forwarding look_up2: " << request_service_name;
     ForwardMessage(request, reply);
   } else if (rule.result == POLICY_DENY_ERROR) {
     // The child is not permitted to look up this service. Send a MIG error
     // reply to the client. Returning a NULL or unserviced port for a look up
@@ skipping 70 matching lines @@
   mig_reply_error_t* error_reply = reinterpret_cast<mig_reply_error_t*>(reply);
   error_reply->Head.msgh_size = sizeof(mig_reply_error_t);
   error_reply->Head.msgh_bits =
       MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND_ONCE);
   error_reply->NDR = NDR_record;
   error_reply->RetCode = error_code;
   SendReply(&error_reply->Head);
 }
 
 }  // namespace sandbox