Split from  bug 754053  comment 6:

content/renderer/renderer.sb has sandbox holes to allow renderers to read the time zone specification.

https://chromium.googlesource.com/chromium/src/+/a2e4f7f5c265cc867f21564d027afaf6a31550a9/content/renderer/renderer.sb#34

34  ; https://crbug.com/288697
35  (allow file-read*
36    (path "/private/etc/localtime")
37    (subpath "/usr/share/zoneinfo"))
38
39  (allow file-read-metadata (path "/private/etc"))

This works for the time zone specification structure on 10.12 and earlier:

% ls -ld /etc
lrwxr-xr-x@ 1 root  wheel  11 Sep 20  2016 /etc -> private/etc
% ls -l /etc/localtime
lrwxr-xr-x  1 root  wheel  36 Sep 20  2016 /etc/localtime -> /usr/share/zoneinfo/America/New_York
% ls -ld /usr/share/zoneinfo
drwxr-xr-x  67 root  wheel  2278 Jul 19 15:50 /usr/share/zoneinfo
% ls -l /usr/share/zoneinfo/America/New_York
-rw-r--r--  3 root  wheel  1267 Aug 29  2016 /usr/share/zoneinfo/America/New_York
% sw_vers
ProductName:	Mac OS X
ProductVersion:	10.12.6
BuildVersion:	16G29

The structure has changed in 10.13:

$ ls -ld /etc
lrwxr-xr-x@ 1 root  wheel  11 Aug  7 18:43 /etc -> private/etc
$ ls -l /etc/localtime
lrwxr-xr-x  1 root  wheel  29 Aug  7 18:55 /etc/localtime -> /var/db/timezone/zoneinfo/UTC
$ ls -ld /var
lrwxr-xr-x@ 1 root  wheel  11 Aug  7 18:43 /var -> private/var
$ ls -ld /var/db/timezone/zoneinfo
lrwxr-xr-x  1 root  wheel  27 Aug  7 18:43 /var/db/timezone/zoneinfo -> /usr/share/zoneinfo.default
$ ls -l /var/db/timezone/zoneinfo/UTC
-rw-r--r--  6 root  wheel  118 Aug  2 01:13 /var/db/timezone/zoneinfo/UTC
$ ls -ld /usr/share/zoneinfo
lrwxr-xr-x  1 root  wheel  25 Aug  7 18:43 /usr/share/zoneinfo -> /var/db/timezone/zoneinfo
$ sw_vers
ProductName:	Mac OS X
ProductVersion:	10.13
BuildVersion:	17A330h

such that we probably now need to broaden our sandbox holes to allow this to work properly.

Do we still do OS version-specific sandbox rules?