[Mac] Shut down connections to WindowServer before engaging the sandbox.

content/renderer/renderer_main_platform_delegate_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/renderer_main_platform_delegate.h"
 
 #include <Carbon/Carbon.h>
 #import <Cocoa/Cocoa.h>
 #include <objc/runtime.h>
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/mac/mac_util.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/sys_string_conversions.h"
 #include "content/common/sandbox_mac.h"
 #include "content/public/common/content_switches.h"
 #include "content/common/sandbox_init_mac.h"
 
+extern "C" {
+void CGSSetDenyWindowServerConnections(bool);
+void CGSShutdownServerConnections();
+};
+
 namespace content {
 
 namespace {
 
 // You are about to read a pretty disgusting hack. In a static initializer,
 // CoreFoundation decides to connect with cfprefsd(8) using Mach IPC. There is
 // no public way to close this Mach port after-the-fact, nor a way to stop it
 // from happening since it is done pre-main in dyld. But the address of the
 // CFMachPort can be found in the run loop's string description. Below, that
 // address is parsed, cast, and then used to invalidate the Mach port to
@@ skipping 98 matching lines @@
     [NSThread detachNewThreadSelector:@selector(length)
                              toTarget:string
                            withObject:nil];
   }
 }
 
 void RendererMainPlatformDelegate::PlatformUninitialize() {
 }
 
 bool RendererMainPlatformDelegate::EnableSandbox() {
+  // Disconnect from WindowServer before entering the sandbox, after all
+  // objects have been warmed up. Shutting down the connection requires
+  // connecting to WindowServer, so do this before engaging the sandbox.

[Avi (use Gerrit), 2014/09/04 20:10:54]

"It's like having to connect to the WindowServer to shut down the connection to
the WindowServer"

+  CGSSetDenyWindowServerConnections(true);
+  CGSShutdownServerConnections();
+
   // Enable the sandbox.
   bool sandbox_initialized = InitializeSandbox();
 
   // The sandbox is now engaged. Make sure that the renderer has not connected
   // itself to Cocoa.
   CHECK(NSApp == nil);
 
   DisconnectCFNotificationCenter();
 
   return sandbox_initialized;
 }
 
 }  // namespace content