Bug 1541230 - Part 2 - Add /System/Library read access to the utility sandbox r=Alex_Gaynor

Allow read access to /System/Library for accessing system libraries.

Depends on D26397

Differential Revision: https://phabricator.services.mozilla.com/D26626

--HG--
extra : moz-landing-system : lando

security/sandbox/mac/SandboxPolicyUtility.h

@@ -32,13 +32,11 @@ static const char SandboxPolicyUtility[] = R"SANDBOX_LITERAL(
 
   (if (defined? 'file-map-executable)
     (allow file-map-executable file-read*
-      (subpath "/System/Library/PrivateFrameworks")
+      (subpath "/System/Library")
-      (subpath "/System/Library/Frameworks")
       (subpath "/usr/lib")
       (subpath app-path))
     (allow file-read*
-      (subpath "/System/Library/PrivateFrameworks")
+      (subpath "/System/Library")
-      (subpath "/System/Library/Frameworks")
       (subpath "/usr/lib")
       (subpath app-path)))
 
@@ -50,7 +48,6 @@ static const char SandboxPolicyUtility[] = R"SANDBOX_LITERAL(
   (allow file-read*
     (literal "/dev/random")
     (literal "/dev/urandom")
-    (literal "/System/Library/CoreServices/SystemVersion.plist")
     (subpath "/usr/share/icu"))
 
   (allow mach-lookup