mac: Don't require DYLD_LIBRARY_PATH to be set when using the shared build.

content/common/sandbox_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_mac.h"
 
 #import <Cocoa/Cocoa.h>
 
 extern "C" {
 #include <sandbox.h>
@@ skipping 253 matching lines @@
     CGImageSourceGetStatus(img);
   }
 
   {
     // Allow access to /dev/urandom.
     GetUrandomFD();
   }
 
   // Process-type dependent warm-up.
   if (sandbox_type == content::SANDBOX_TYPE_GPU) {
-     // Preload either the desktop GL or the osmesa so, depending on the
-     // --use-gl flag.
-     gfx::GLSurface::InitializeOneOff();
+    // Preload either the desktop GL or the osmesa so, depending on the
+    // --use-gl flag.
+    gfx::GLSurface::InitializeOneOff();
   }
 }
 
 // static
 NSString* Sandbox::BuildAllowDirectoryAccessSandboxString(
     const FilePath& allowed_dir,
     SandboxVariableSubstitions* substitutions) {
   // A whitelist is used to determine which directories can be statted
   // This means that in the case of an /a/b/c/d/ directory, we may be able to
   // stat the leaf directory, but not its parent.
@@ skipping 91 matching lines @@
   if (common_sandbox_definition.empty()) {
     LOG(FATAL) << "Failed to load the common sandbox profile";
     return nil;
   }
 
   scoped_nsobject<NSString> common_sandbox_prefix_data(
       [[NSString alloc] initWithBytes:common_sandbox_definition.data()
                                length:common_sandbox_definition.length()
                              encoding:NSUTF8StringEncoding]);
 
+#if defined(COMPONENT_BUILD)
+  // dlopen() fails without file-read-metadata access if the executable image
+  // contains LC_RPATH load commands. The components build uses those.
+  // See http://crbug.com/127465
+  if (base::mac::IsOSSnowLeopardOrEarlier()) {
+    NSString* suffixed = [common_sandbox_prefix_data
+        stringByAppendingString:@"\n(allow file-read-metadata)\n"];

[jeremy, 2012/05/30 16:33:17]

Please move these lines to the Sandbox definition file together with a
;SOME_PREFIX which is then removed in component builds.  The rationale for this
is so it would be easy to see the whole sandbox definition in one place.

Also, is there a way we can limit this rule to just a specific subpath rather
than allowing global filesystem access?

[Nico, 2012/05/30 16:38:33]

See bug, it needs file-read-metadata for the currently running binary. But since
this is just used with COMPONENT_BUILD set and running on 10.6, I figured
keeping things simple is the appropriate thing to do.

+    common_sandbox_prefix_data.reset([suffixed retain]);
+  }
+#endif
+
   scoped_nsobject<NSString> sandbox_data(
       [[NSString alloc] initWithBytes:sandbox_definition.data()
                                length:sandbox_definition.length()
                              encoding:NSUTF8StringEncoding]);
 
   // Prefix sandbox_data with common_sandbox_prefix_data.
   return [common_sandbox_prefix_data stringByAppendingString:sandbox_data];
 }
 
 // static
@@ skipping 180 matching lines @@
   if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) {
     DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                  << path->value();
     return;
   }
 
   *path = FilePath(canonical_path);
 }
 
 }  // namespace sandbox