const char *sandbox_profile = '(version 1)'
'(deny default)'
/* * Allow use of semaphores: sem_init() etc. This is required on * OS X 10.6 but not on 10.5. */
'(allow ipc-posix-sem)'
/* * Allow shared memory segments to be created: shm_open() etc.
This * is required on OS X 10.6 but not on 10.5. */
'(allow ipc-posix-shm)';

void NaClEnableOuterSandbox()
{ char *error;
int rc = sandbox_init(sandbox_profile, 0, &error);
if (rc != 0) NaClLog(LOG_FATAL, 'Failed to initialise Mac OS X sandbox: %s\n', error);
}

Labels: entitlements, sandbox, sandbox policy language