Make BootstrapSandboxPolicy a struct, containing the existing rule map and a new default rule.

sandbox/mac/policy.cc

Index: sandbox/mac/policy.cc
diff --git a/sandbox/mac/policy.cc b/sandbox/mac/policy.cc
index 5493c28e4f292543cbd9df8786d05bf86e1c13ee..5c599490c4bb7d73a3066ee60ee94723cf3ec094 100644
--- a/sandbox/mac/policy.cc
+++ b/sandbox/mac/policy.cc
@@ -21,22 +21,37 @@ Rule::Rule(mach_port_t override_port)
       substitute_port(override_port) {
 }
 
+BootstrapSandboxPolicy::BootstrapSandboxPolicy()
+    : default_rule(POLICY_DENY_ERROR) {
+}
+
+BootstrapSandboxPolicy::~BootstrapSandboxPolicy() {}
+
+static bool IsRuleValid(const Rule& rule) {
+  if (!(rule.result > POLICY_DECISION_INVALID &&
+        rule.result < POLICY_DECISION_LAST)) {
+    return false;
+  }
+  if (rule.result == POLICY_SUBSTITUTE_PORT) {
+    if (rule.substitute_port == MACH_PORT_NULL)
+      return false;
+  } else {
+    if (rule.substitute_port != MACH_PORT_NULL)
+      return false;
+  }
+  return true;
+}
+
 bool IsPolicyValid(const BootstrapSandboxPolicy& policy) {
-  for (BootstrapSandboxPolicy::const_iterator it = policy.begin();
-       it != policy.end();
+  if (!IsRuleValid(policy.default_rule))
+    return false;
+
+  for (BootstrapSandboxPolicy::NamedRules::const_iterator it =

[Mark Mentovai, 2014/06/03 16:57:27]

You can just write "for (const auto& kv : policy.rules)" now (or if you don’t
like auto, you can use “const BootstrapSandboxPolicy::NamedRules::value_type&”
or “const std::pair<std::string, Rule>&”.

[Robert Sesek, 2014/06/03 17:30:52]

I like const auto&.

+           policy.rules.begin();
+       it != policy.rules.end();
        ++it) {
-    const Rule& rule = it->second;
-    if (!(rule.result > POLICY_DECISION_INVALID &&
-          rule.result < POLICY_DECISION_LAST)) {
+    if (!IsRuleValid(it->second))
       return false;
-    }
-    if (rule.result == POLICY_SUBSTITUTE_PORT) {
-      if (rule.substitute_port == MACH_PORT_NULL)
-        return false;
-    } else {
-      if (rule.substitute_port != MACH_PORT_NULL)
-        return false;
-    }
   }
   return true;
 }