[Sandbox] Allow mac TCSM sysctl in nacl_loader process

Bug: 963490
Change-Id: I982e81cd76f0aa0717aa9e0cdcb0b8531df41873
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1618076
Commit-Queue: Derek Schuff <dschuff@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#661364}

services/service_manager/sandbox/mac/nacl_loader.sb

@@ -36,3 +36,10 @@
   (global-name "com.apple.PowerManagement.control")
   (global-name "com.apple.system.notification_center")
 )
+
+(if (>= os-version 1014)
+  ; Ordering of these tcsm sysctls matters. See: https://crbug.com/964353
+  (allow sysctl-read (sysctl-name "kern.tcsm_enable"))
+  (allow sysctl-write (sysctl-name "kern.tcsm_enable"))
+  (allow sysctl-read (sysctl-name "kern.tcsm_available"))
+)