Define a bootstrap sandbox policy for renderer processes and enable it.

content/browser/mach_broker_mac.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_MACH_BROKER_MAC_H_
 #define CONTENT_BROWSER_MACH_BROKER_MAC_H_
 
 #include <map>
 #include <string>
 
@@ skipping 26 matching lines @@
 class CONTENT_EXPORT MachBroker : public base::ProcessMetrics::PortProvider,
                                   public BrowserChildProcessObserver,
                                   public NotificationObserver {
  public:
   // For use in child processes. This will send the task port of the current
   // process over Mach IPC to the port registered by name (via this class) in
   // the parent process. Returns true if the message was sent successfully
   // and false if otherwise.
   static bool ChildSendTaskPortToParent();
 
+  // Returns the Mach port name to use when sending or receiving messages.
+  // Does the Right Thing in the browser and in child processes.
+  static std::string GetMachPortName();
+
   // Returns the global MachBroker.
   static MachBroker* GetInstance();
 
   // The lock that protects this MachBroker object.  Clients MUST acquire and
   // release this lock around calls to EnsureRunning(), PlaceholderForPid(),
   // and FinalizePid().
   base::Lock& GetLock();
 
   // Performs any necessary setup that cannot happen in the constructor.
   // Callers MUST acquire the lock given by GetLock() before calling this
@@ skipping 29 matching lines @@
 
   // Updates the mapping for |pid| to include the given |mach_info|.  Does
   // nothing if PlaceholderForPid() has not already been called for the given
   // |pid|.  Callers MUST acquire the lock given by GetLock() before calling
   // this method (and release the lock afterwards).
   void FinalizePid(base::ProcessHandle pid, mach_port_t task_port);
 
   // Removes all mappings belonging to |pid| from the broker.
   void InvalidatePid(base::ProcessHandle pid);
 
-  // Returns the Mach port name to use when sending or receiving messages.
-  // Does the Right Thing in the browser and in child processes.
-  static std::string GetMachPortName();
   // Callback used to register notifications on the UI thread.
   void RegisterNotifications();
 
   // True if the listener thread has been started.
   bool listener_thread_started_;
 
   // Used to register for notifications received by NotificationObserver.
   // Accessed only on the UI thread.
   NotificationRegistrar registrar_;
 
   // Stores mach info for every process in the broker.
   typedef std::map<base::ProcessHandle, mach_port_t> MachMap;
   MachMap mach_map_;
 
   // Mutex that guards |mach_map_|.
   mutable base::Lock lock_;
 
   DISALLOW_COPY_AND_ASSIGN(MachBroker);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_MACH_BROKER_MAC_H_