services/service_manager/sandbox/mac/pdf_compositor.sb

;; Copyright 2018 The Chromium Authors. All rights reserved.
;; Use of this source code is governed by a BSD-style license that can be
;; found in the LICENSE file.
;;
; This is the sandbox configuration file used for safeguarding the pdf
; compositor service which is used for compositing web contents printed from
; different renderer processes.
;
; This configuration locks everything down, except font accesses.
;

; *** The contents of common.sb are implicitly included here. ***

; Needed for Fonts.
(allow-font-access)

; Reads from /System.
(allow file-read-data
  (subpath "/System/Library/ColorSync/Profiles")  ; https://crbug.com/822218
)

; This is available in 10.15+, and rolled out as a Finch experiment.
(if (param-true? filter-syscalls-debug)
  (when (defined? 'syscall-unix)
    (deny syscall-unix (with send-signal SIGSYS))
    (allow syscall-unix
      (syscall-number SYS_fsgetpath)
      (syscall-number SYS_getfsstat64)
      (syscall-number SYS_mkdir)
      (syscall-number SYS_pathconf)
      (syscall-number SYS_sigaltstack)
      (syscall-number SYS_write)
)))