[Mac] Fix form control rendering on 10.14 Mojave.

The renderers need to talk to the CVMS server (OpenCL compiler), which
then outputs codesigned blobs that can be loaded in to the process. This
is required for drawing the form controls.

In addition, another Metal bundle location (in /Library) is permitted.

Bug: 850021, 847518
Change-Id: I67106972baf5fc55fccd8f7deff3f47cbea076b5
Reviewed-on: https://chromium-review.googlesource.com/1103127Reviewed-by: Greg Kerr <kerrnel@chromium.org>
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567877}

services/service_manager/sandbox/mac/renderer_v2.sb

@@ -18,6 +18,11 @@
   (path "/dev/autofs_nowait")
   (path "/dev/fd"))
 
+; Reads of signed Mach-O blobs created by the CVMS server.
+; https://crbug.com/850021
+(allow file-read-data
+  (prefix "/private/tmp/cvmsCodeSignObj"))
+
 (allow file-write-data
   (require-all
     (path "/dev/null")
@@ -37,6 +42,10 @@
   (subpath "/System/Library/Extensions")  ; https://crbug.com/847518
   (subpath "/System/Library/LinguisticData"))
 
+; Reads from /Library.
+(allow file-read-data
+  (subpath "/Library/GPUBundles"))  ; https://crbug.com/850021
+
 ; IOKit
 (allow iokit-open
   (iokit-registry-entry-class "IOSurfaceRootUserClient")
@@ -54,6 +63,8 @@
   ; crbug.com/792257
   (global-name "com.apple.distributed_notifications@Uv3")
   (global-name "com.apple.lsd.mapdb")
+  ; https://crbug.com/850021
+  (global-name "com.apple.cvmsServ")
   ; crbug.com/792217
   (global-name "com.apple.system.notification_center")
   (global-name "com.apple.windowserver.active"))