Make BootstrapSandboxPolicy a struct, containing the existing rule map and a new default rule.

sandbox/mac/policy_unittest.cc

Index: sandbox/mac/policy_unittest.cc
diff --git a/sandbox/mac/policy_unittest.cc b/sandbox/mac/policy_unittest.cc
index d019fdd0647869b70ba094d43291057b18d17e08..54e0e7489518b540b602abaaa1e368f43b87050e 100644
--- a/sandbox/mac/policy_unittest.cc
+++ b/sandbox/mac/policy_unittest.cc
@@ -14,24 +14,24 @@ TEST(PolicyTest, ValidEmptyPolicy) {
 
 TEST(PolicyTest, ValidPolicy) {
   BootstrapSandboxPolicy policy;
-  policy["allow"] = Rule(POLICY_ALLOW);
-  policy["deny_error"] = Rule(POLICY_DENY_ERROR);
-  policy["deny_dummy"] = Rule(POLICY_DENY_DUMMY_PORT);
-  policy["substitue"] = Rule(mach_task_self());
+  policy.rules["allow"] = Rule(POLICY_ALLOW);
+  policy.rules["deny_error"] = Rule(POLICY_DENY_ERROR);
+  policy.rules["deny_dummy"] = Rule(POLICY_DENY_DUMMY_PORT);
+  policy.rules["substitue"] = Rule(mach_task_self());
   EXPECT_TRUE(IsPolicyValid(policy));
 }
 
 TEST(PolicyTest, InvalidPolicyEmptyRule) {
   Rule rule;
   BootstrapSandboxPolicy policy;
-  policy["test"] = rule;
+  policy.rules["test"] = rule;
   EXPECT_FALSE(IsPolicyValid(policy));
 }
 
 TEST(PolicyTest, InvalidPolicySubstitue) {
   Rule rule(POLICY_SUBSTITUTE_PORT);
   BootstrapSandboxPolicy policy;
-  policy["test"] = rule;
+  policy.rules["test"] = rule;
   EXPECT_FALSE(IsPolicyValid(policy));
 }
 
@@ -39,7 +39,7 @@ TEST(PolicyTest, InvalidPolicyWithPortAllow) {
   Rule rule(POLICY_ALLOW);
   rule.substitute_port = mach_task_self();
   BootstrapSandboxPolicy policy;
-  policy["allow"] = rule;
+  policy.rules["allow"] = rule;
   EXPECT_FALSE(IsPolicyValid(policy));
 }
 
@@ -47,7 +47,7 @@ TEST(PolicyTest, InvalidPolicyWithPortDenyError) {
   Rule rule(POLICY_DENY_ERROR);
   rule.substitute_port = mach_task_self();
   BootstrapSandboxPolicy policy;
-  policy["deny_error"] = rule;
+  policy.rules["deny_error"] = rule;
   EXPECT_FALSE(IsPolicyValid(policy));
 }
 
@@ -55,7 +55,43 @@ TEST(PolicyTest, InvalidPolicyWithPortDummy) {
   Rule rule(POLICY_DENY_DUMMY_PORT);
   rule.substitute_port = mach_task_self();
   BootstrapSandboxPolicy policy;
-  policy["deny_dummy"] = rule;
+  policy.rules["deny_dummy"] = rule;
+  EXPECT_FALSE(IsPolicyValid(policy));
+}
+
+TEST(PolicyTest, InvalidPolicyDefaultRule) {
+  BootstrapSandboxPolicy policy;
+  policy.default_rule = Rule();
+  EXPECT_FALSE(IsPolicyValid(policy));
+}
+
+TEST(PolicyTest, InvalidPolicyDefaultRuleSubstitue) {
+  BootstrapSandboxPolicy policy;
+  policy.default_rule = Rule(POLICY_SUBSTITUTE_PORT);
+  EXPECT_FALSE(IsPolicyValid(policy));
+}
+
+TEST(PolicyTest, InvalidPolicyDefaultRuleWithPortAllow) {
+  Rule rule(POLICY_ALLOW);
+  rule.substitute_port = mach_task_self();
+  BootstrapSandboxPolicy policy;
+  policy.default_rule = rule;
+  EXPECT_FALSE(IsPolicyValid(policy));
+}
+
+TEST(PolicyTest, InvalidPolicyDefaultRuleWithPortDenyError) {
+  Rule rule(POLICY_DENY_ERROR);
+  rule.substitute_port = mach_task_self();
+  BootstrapSandboxPolicy policy;
+  policy.default_rule = rule;
+  EXPECT_FALSE(IsPolicyValid(policy));
+}
+
+TEST(PolicyTest, InvalidPolicyDefaultRuleWithPortDummy) {
+  Rule rule(POLICY_DENY_DUMMY_PORT);
+  rule.substitute_port = mach_task_self();
+  BootstrapSandboxPolicy policy;
+  policy.default_rule = rule;
   EXPECT_FALSE(IsPolicyValid(policy));
 }