Allow /dev/urandom from ppapi sandbox.

content/common/sandbox_mac_system_access_unittest.mm

Index: content/common/sandbox_mac_system_access_unittest.mm
diff --git a/content/common/sandbox_mac_system_access_unittest.mm b/content/common/sandbox_mac_system_access_unittest.mm
index d9086ebd6da06ed32b211e630a4965eaebf4128b..4fc68a576c2cf96c15c38f9aa28263364c0f620a 100644
--- a/content/common/sandbox_mac_system_access_unittest.mm
+++ b/content/common/sandbox_mac_system_access_unittest.mm
@@ -96,4 +96,40 @@ TEST_F(MacSandboxTest, FileAccess) {
   EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedFileAccessTestCase", NULL));
 }
 
+//--------------------- /dev/urandom Sandboxing ----------------------
+// /dev/urandom is available to ppapi sandbox only.
+class MacSandboxedUrandomTestCase : public sandboxtest::MacSandboxTestCase {
+ public:
+  virtual bool SandboxedTest();
+};
+
+REGISTER_SANDBOX_TEST_CASE(MacSandboxedUrandomTestCase);
+
+bool MacSandboxedUrandomTestCase::SandboxedTest() {
+  int fdes = open("/dev/urandom", O_RDONLY);
+  file_util::ScopedFD file_closer(&fdes);
+
+  // Open succeeds under ppapi sandbox, else it is not permitted.
+  if (test_data_ == "ppapi") {
+    return fdes != -1;
+  } else {
+    return fdes == -1 && errno == EPERM;
+  }
+}
+
+TEST_F(MacSandboxTest, UrandomAccess) {
+  // Similar to RunTestInAllSandboxTypes(), except changing
+  // |test_data| for the ppapi case.  Passing "" in the non-ppapi case
+  // to overwrite the test data (NULL means not to change it).
+  for (content::SandboxType i = content::SANDBOX_TYPE_FIRST_TYPE;
+       i < content::SANDBOX_TYPE_AFTER_LAST_TYPE; ++i) {
+    if (i == content::SANDBOX_TYPE_PPAPI) {
+      EXPECT_TRUE(RunTestInSandbox(i, "MacSandboxedUrandomTestCase", "ppapi"));
+    } else {
+      EXPECT_TRUE(RunTestInSandbox(i, "MacSandboxedUrandomTestCase", ""))
+          << "for sandbox type " << i;
+    }
+  }
+}
+
 }  // namespace