sandbox: Extend BrokerPolicy to support file creation

sandbox/linux/syscall_broker/broker_process.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/syscall_broker/broker_process.h"
 
 #include <fcntl.h>
 #include <signal.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
@@ skipping 10 matching lines @@
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/process/process_metrics.h"
 #include "build/build_config.h"
 #include "sandbox/linux/syscall_broker/broker_client.h"
 #include "sandbox/linux/syscall_broker/broker_host.h"
 
 namespace sandbox {
 
-BrokerProcess::BrokerProcess(int denied_errno,
-                             const std::vector<std::string>& allowed_r_files,
-                             const std::vector<std::string>& allowed_w_files,
-                             bool fast_check_in_client,
-                             bool quiet_failures_for_tests)
+BrokerProcess::BrokerProcess(
+    int denied_errno,
+    const std::vector<syscall_broker::BrokerPermission>& permissions,
+    bool fast_check_in_client,
+    bool quiet_failures_for_tests)
     : initialized_(false),
       is_child_(false),
       fast_check_in_client_(fast_check_in_client),
       quiet_failures_for_tests_(quiet_failures_for_tests),
       broker_pid_(-1),
-      policy_(denied_errno, allowed_r_files, allowed_w_files),
+      policy_(denied_errno, permissions),
       ipc_socketpair_(-1) {
 }
 
 BrokerProcess::~BrokerProcess() {
   if (initialized_ && ipc_socketpair_ != -1) {
     // Closing the socket should be enough to notify the child to die,
     // unless it has been duplicated.
     PCHECK(0 == IGNORE_EINTR(close(ipc_socketpair_)));
     PCHECK(0 == kill(broker_pid_, SIGKILL));
     siginfo_t process_info;
@@ skipping 63 matching lines @@
   RAW_CHECK(initialized_);
   return broker_client_->Access(pathname, mode);
 }
 
 int BrokerProcess::Open(const char* pathname, int flags) const {
   RAW_CHECK(initialized_);
   return broker_client_->Open(pathname, flags);
 }
 
 }  // namespace sandbox.