summaryrefslogtreecommitdiffstats
path: root/chrome/common/sandbox_mac.mm
diff options
context:
space:
mode:
Diffstat (limited to 'chrome/common/sandbox_mac.mm')
-rw-r--r--chrome/common/sandbox_mac.mm46
1 files changed, 4 insertions, 42 deletions
diff --git a/chrome/common/sandbox_mac.mm b/chrome/common/sandbox_mac.mm
index 6eac34c..ae55b52 100644
--- a/chrome/common/sandbox_mac.mm
+++ b/chrome/common/sandbox_mac.mm
@@ -84,42 +84,11 @@ void SandboxWarmup() {
}
// Turns on the OS X sandbox for this process.
-bool EnableSandbox(SandboxProcessType sandbox_type,
- const FilePath& allowed_dir) {
- // Sanity - currently only SANDBOX_TYPE_UTILITY supports a directory being
- // passed in.
- if (sandbox_type != SANDBOX_TYPE_UTILITY) {
- DCHECK(allowed_dir.empty())
- << "Only SANDBOX_TYPE_UTILITY allows a custom directory parameter.";
- } else {
- DCHECK(!allowed_dir.empty())
- << "SANDBOX_TYPE_UTILITY "
- << "needs a custom directory parameter, but an empty one was provided.";
- }
-
- // We use a custom sandbox definition file to lock things down as
- // tightly as possible.
- // TODO(jeremy): Look at using include syntax to unify common parts of sandbox
- // definition files.
- NSString* sandbox_config_filename = nil;
- switch (sandbox_type) {
- case SANDBOX_TYPE_RENDERER:
- sandbox_config_filename = @"renderer";
- break;
- case SANDBOX_TYPE_WORKER:
- sandbox_config_filename = @"worker";
- break;
- case SANDBOX_TYPE_UTILITY:
- sandbox_config_filename = @"utility";
- break;
- default:
- NOTREACHED();
- return false;
- }
-
+bool EnableSandbox() {
+ // For the renderer, we give it a custom sandbox to lock things down as
+ // tightly as possible, while still enabling drawing.
NSString* sandbox_profile_path =
- [mac_util::MainAppBundle() pathForResource:sandbox_config_filename
- ofType:@"sb"];
+ [mac_util::MainAppBundle() pathForResource:@"renderer" ofType:@"sb"];
NSString* sandbox_data = [NSString
stringWithContentsOfFile:sandbox_profile_path
encoding:NSUTF8StringEncoding
@@ -139,13 +108,6 @@ bool EnableSandbox(SandboxProcessType sandbox_type,
withString:@""];
}
- if (!allowed_dir.empty()) {
- NSString* allowed_dir_ns = base::SysUTF8ToNSString(allowed_dir.value());
- sandbox_data = [sandbox_data
- stringByReplacingOccurrencesOfString:@"DIR_TO_ALLOW_ACCESS"
- withString:allowed_dir_ns];
- }
-
int32 major_version, minor_version, bugfix_version;
base::SysInfo::OperatingSystemVersionNumbers(&major_version,
&minor_version, &bugfix_version);