sandbox: Extend BrokerPolicy to support file creation

sandbox/linux/syscall_broker/broker_client.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/syscall_broker/broker_client.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
@@ skipping 35 matching lines @@
     RAW_CHECK(kCurrentProcessOpenFlagsMask == O_CLOEXEC);
     recvmsg_flags |= MSG_CMSG_CLOEXEC;
     flags &= ~O_CLOEXEC;
   }
 
   // There is no point in forwarding a request that we know will be denied.
   // Of course, the real security check needs to be on the other side of the
   // IPC.
   if (fast_check_in_client_) {
     if (syscall_type == COMMAND_OPEN &&
-        !broker_policy_.GetFileNameIfAllowedToOpen(pathname, flags, NULL)) {
+        !broker_policy_.GetFileNameIfAllowedToOpen(pathname, flags, NULL,
+                                                   NULL)) {
       return -broker_policy_.denied_errno();
     }
     if (syscall_type == COMMAND_ACCESS &&
         !broker_policy_.GetFileNameIfAllowedToAccess(pathname, flags, NULL)) {
       return -broker_policy_.denied_errno();
     }
   }
 
   Pickle write_pickle;
   write_pickle.WriteInt(syscall_type);
@@ skipping 68 matching lines @@
   return PathAndFlagsSyscall(COMMAND_ACCESS, pathname, mode);
 }
 
 int BrokerClient::Open(const char* pathname, int flags) const {
   return PathAndFlagsSyscall(COMMAND_OPEN, pathname, flags);
 }
 
 }  // namespace syscall_broker
 
 }  // namespace sandbox