Define a bootstrap sandbox policy for renderer processes and enable it.

content/browser/mach_broker_mac.h

Index: content/browser/mach_broker_mac.h
diff --git a/content/browser/mach_broker_mac.h b/content/browser/mach_broker_mac.h
index 51038bfa010831beed3b735850649fa2a081fab3..dede40068eb42f87d05980eef7c83b65006d87da 100644
--- a/content/browser/mach_broker_mac.h
+++ b/content/browser/mach_broker_mac.h
@@ -44,6 +44,10 @@ class CONTENT_EXPORT MachBroker : public base::ProcessMetrics::PortProvider,
   // and false if otherwise.
   static bool ChildSendTaskPortToParent();
 
+  // Returns the Mach port name to use when sending or receiving messages.
+  // Does the Right Thing in the browser and in child processes.
+  static std::string GetMachPortName();
+
   // Returns the global MachBroker.
   static MachBroker* GetInstance();
 
@@ -93,9 +97,6 @@ class CONTENT_EXPORT MachBroker : public base::ProcessMetrics::PortProvider,
   // Removes all mappings belonging to |pid| from the broker.
   void InvalidatePid(base::ProcessHandle pid);
 
-  // Returns the Mach port name to use when sending or receiving messages.
-  // Does the Right Thing in the browser and in child processes.
-  static std::string GetMachPortName();
   // Callback used to register notifications on the UI thread.
   void RegisterNotifications();