Fix Mac sandbox meta data access

content/common/sandbox_mac_diraccess_unittest.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 #include <dirent.h>
 
 extern "C" {
 #include <sandbox.h>
 }
@@ skipping 109 matching lines @@
     expected.push_back('^');
     for (size_t i = 0; i < in_utf8.length(); ++i) {
       expected.push_back('\\');
       expected.push_back(in_utf8[i]);
     }
     expected.append(kSandboxEscapeSuffix);
 
     std::string out;
     EXPECT_TRUE(Sandbox::QuoteStringForRegex(in_utf8, &out));
     EXPECT_EQ(expected, out);
-
   }
 }
 
 // A class to handle auto-deleting a directory.
 struct ScopedDirectoryDelete {
   inline void operator()(base::FilePath* x) const {
     if (x)
       base::DeleteFile(*x, true);
   }
 };
@@ skipping 30 matching lines @@
         std::string(sandbox_dir_cases[i]) + kDeniedSuffix;
     base::FilePath sibling_sandbox_dir = tmp_dir.Append(
                                       sibling_sandbox_dir_name_denied.c_str());
     ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir));
     ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir);
 
     EXPECT_TRUE(CheckSandbox(sandbox_dir.value()));
   }
 }
 
+TEST_F(MacDirAccessSandboxTest, AllowMetadataForPath) {
+  {
+    std::string expected(
+        "(allow file-read-metadata (literal \"/\")(literal \"/System\")"
+        "(literal \"/System/Library\")"
+        "(literal \"/System/Library/Frameworks\"))");
+    NSString* sandbox_command = Sandbox::AllowMetadataForPath(
+        base::FilePath("/System/Library/Frameworks"));
+    EXPECT_EQ(base::SysNSStringToUTF8(sandbox_command), expected);
+  }
+}
+
 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) {
   char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey);
   if (!sandbox_allowed_dir)
     return -1;
 
   // Build up a sandbox profile that only allows access to a single directory.
   NSString *sandbox_profile =
       @"(version 1)" \
       "(deny default)" \
       "(allow signal (target self))" \
@@ skipping 109 matching lines @@
     PLOG(ERROR) << "Sandbox breach: was able to write ("
                 << denied_file2.value()
                 << ")";
     return -1;
   }
 
   return 0;
 }
 
 }  // namespace content