Sandbox Worker process on the Mac.

* Add plumbing to allow multiple Sandbox profiles on OS X.
* Separate sandbox_init_wrapper into platform specific files.
* Sandbox Worker process & add plumbing to Sandbox utility process when we bring that up.
* Remove mention of stale bugs in utility process on Mac.

BUG=23582
TEST=Worker process should work.

Review URL: http://codereview.chromium.org/341033

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@31089 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 24 insertions, 1 deletions

diff --git a/chrome/common/sandbox_mac.h b/chrome/common/sandbox_mac.h
index c747e20..a8a55b0 100644
--- a/chrome/common/sandbox_mac.h
+++ b/chrome/common/sandbox_mac.h
@@ -5,14 +5,37 @@
 #ifndef CHROME_COMMON_SANDBOX_MAC_H_
 #define CHROME_COMMON_SANDBOX_MAC_H_
 
+#include "base/file_path.h"
+
 namespace sandbox {
 
+enum SandboxProcessType {
+  SANDBOX_TYPE_RENDERER,
+
+  // Worker process has *everything* not needed for Cocoa locked down.
+  SANDBOX_TYPE_WORKER,
+
+  // Utility process is as restrictive as the worker process except full access
+  // is allowed to one configurable directory.
+  SANDBOX_TYPE_UTILITY,
+};
+
 // Warm up System APIs that empirically need to be accessed before the Sandbox
 // is turned on.
 void SandboxWarmup();
 
 // Turns on the OS X sandbox for this process.
-bool EnableSandbox();
+// |sandbox_type| - type of Sandbox to use.
+// |allowed_dir| - directory to allow access to, currently the only sandbox
+// profile that supports this is SANDBOX_TYPE_UTILITY .
+//
+// |allowed_dir| must be a "simple" string since it's placed as is in a regex
+// i.e. it must not contain quotation characters, escaping or any characters
+// that might have special meaning when blindly substituted into a regular
+// expression - crbug.com/26492 .
+// Returns true on success, false if an error occurred enabling the sandbox.
+bool EnableSandbox(SandboxProcessType sandbox_type,
+                   const FilePath& allowed_dir);
 
 }  // namespace sandbox