Fix Mac sandbox meta data access (reland)

content/common/sandbox_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_mac.h"
 
 #import <Cocoa/Cocoa.h>
 
 #include <CoreFoundation/CFTimeZone.h>
 extern "C" {
@@ skipping 96 matching lines @@
   DLOG(FATAL) << "String quoting failed " << bad_string;
 }
 
 }  // namespace
 
 // static
 NSString* Sandbox::AllowMetadataForPath(const base::FilePath& allowed_path) {
   // Collect a list of all parent directories.
   base::FilePath last_path = allowed_path;
   std::vector<base::FilePath> subpaths;
-  for (base::FilePath path = allowed_path;
-       path.value() != last_path.value();
-       path = path.DirName()) {
+
+  base::FilePath path = allowed_path;
+  do {
     subpaths.push_back(path);
+
     last_path = path;
-  }
+    path = path.DirName();
+  } while (path.value() != last_path.value());
 
   // Iterate through all parents and allow stat() on them explicitly.
   NSString* sandbox_command = @"(allow file-read-metadata ";
   for (std::vector<base::FilePath>::reverse_iterator i = subpaths.rbegin();
        i != subpaths.rend();
        ++i) {
     std::string subdir_escaped;
     if (!QuotePlainString(i->value(), &subdir_escaped)) {
       FatalStringQuoteException(i->value());
       return nil;
@@ skipping 430 matching lines @@
   substitutions["COMPONENT_BUILD_WORKAROUND"] = SandboxSubstring("");
 #if defined(COMPONENT_BUILD)
   // dlopen() fails without file-read-metadata access if the executable image
   // contains LC_RPATH load commands. The components build uses those.
   // See http://crbug.com/127465
   if (base::mac::IsOSSnowLeopard()) {
     base::FilePath bundle_executable = base::mac::NSStringToFilePath(
         [base::mac::MainBundle() executablePath]);
     NSString* sandbox_command = AllowMetadataForPath(
         GetCanonicalSandboxPath(bundle_executable));
+
+    // In addition to the workaround above, for OS X <= 10.6 we also need to
+    // allow reading file metadata for all the dylibs under the same directory
+    // containing the Chrome bundle. It requires to go 5 levels up from main
+    // bundle path because the main bundle here is the Helper.app bundle.
+    base::FilePath product_path = base::mac::MainBundlePath()
+                                      .DirName()
+                                      .DirName()
+                                      .DirName()
+                                      .DirName()
+                                      .DirName();
+    sandbox_command = [sandbox_command
+        stringByAppendingFormat:
+            @"(allow file-read-metadata (regex #\"^%@/.*\\.dylib$\"))",
+            base::mac::FilePathToNSString(product_path)];
+
     substitutions["COMPONENT_BUILD_WORKAROUND"] =
         SandboxSubstring(base::SysNSStringToUTF8(sandbox_command));
   }
 #endif
 
   // All information needed to assemble the final profile has been collected.
   // Merge it all together.
   std::string final_sandbox_profile_str;
   if (!PostProcessSandboxProfile(sandbox_data, tokens_to_remove, substitutions,
                                  &final_sandbox_profile_str)) {
@@ skipping 31 matching lines @@
   if (HANDLE_EINTR(fcntl(fd.get(), F_GETPATH, canonical_path)) != 0) {
     DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                  << path.value();
     return path;
   }
 
   return base::FilePath(canonical_path);
 }
 
 }  // namespace content