blob: 341652f884af3478658d63a780c3c22f4e0619dd [file] [log] [blame]
[email protected]e8aa85c2009-02-17 19:08:441;;
2;; Copyright (c) 2009 The Chromium Authors. All rights reserved.
3;; Use of this source code is governed by a BSD-style license that can be
4;; found in the LICENSE file.
5;;
[email protected]e8aa85c2009-02-17 19:08:446
[email protected]1e652d022010-04-16 19:09:117; *** The contents of chrome/common/common.sb are implicitly included here. ***
[email protected]3a3e5b32009-08-21 22:30:478
9; Needed for Fonts.
[email protected]8e7b2d532010-03-07 12:14:3510(allow file-read-data (regex #"^/System/Library/Fonts($|/)")) ; 10.5.6
11;10.6_ONLY (allow file-read-data (regex #"^/Library/Fonts($|/)")) ; 10.6
[email protected]3e218312009-04-16 21:33:0912(allow mach-lookup (global-name "com.apple.FontObjectsServer")) ; 10.5.6
[email protected]810d6402009-10-09 16:23:1013;10.6_ONLY (allow mach-lookup (global-name "com.apple.FontServer")) ; 10.6
[email protected]3a3e5b32009-08-21 22:30:4714
[email protected]179564f2010-04-02 14:01:4215; USER_HOMEDIR is substitued at runtime - http://crbug.com/11269
[email protected]810d6402009-10-09 16:23:1016;10.6_ONLY (allow file-read-data (subpath "USER_HOMEDIR/Library/Fonts")) ; 10.6
[email protected]04bd2bb52009-05-05 20:07:1917
[email protected]179564f2010-04-02 14:01:4218; Needed for the Native Client plugin and loader. These lines are enabled
19; if and only if --internal-nacl (or --enable-nacl) are used (and they
20; are off by default).
21; TODO(msneck): Refactor Native Client to use something other than Unix
22; sockets. Then change or remove the code in chrome/common/sandbox_mac.mm
23; which deals with the ";NACL" prefix.
24; See http://code.google.com/p/nativeclient/issues/detail?id=344
25;NACL;BEFORE_10.6 (allow network-inbound (from unix-socket))
26;NACL;BEFORE_10.6 (allow network-outbound (to unix-socket))
27;NACL;10.6_ONLY (allow network-inbound (regex #"^(/private)?/tmp/nacl-"))
28;NACL;10.6_ONLY (allow network-outbound (regex #"^(/private)?/tmp/nacl-"))
29;NACL;10.6_ONLY (allow network-bind (local ip4))
[email protected]1e652d022010-04-16 19:09:1130;NACL;10.6_ONLY (allow file-write* (regex #"^(/private)?/tmp/nacl-"))