+kerrnel/rsesek@ for sandbox

Thanks for the report. Is there a web-site I can visit to trigger this DRM behavior? That way I can reproduce and tweak the sandbox profile, assuming this is the sandbox causing it.

Thanks for picking this up.
Our test player is hosted at http://drmtest2.adobe.com/AccessPlayer/player.html. 
To reproduce the issue, copy the following DRM protected stream URL in the 'Media URL'
http://de9b7h88wgj5l.cloudfront.net/static/users/ankmathu/protected/sintel/sintel-1024-stereo.m3u8 
Now try to play this (using the play button on bottom left)
On latest Chrome, this video stream fails to start video playback with "Error: 3338 [null]"  (shown in the logs on the right pane).
On Chrome versions older than 66, the video plays fine. It plays fine on the latest Firefox as well.
The issue is specific to Mac OSX.

To ensure a clean environment before playing the stream, clean up the caches by deleting all the contents at following paths: 
~/Library/Application\ Support/Google/Chrome/Default/Pepper\ Data/Shockwave\ Flash/CacheWritableAdobeRoot/0/*
~/Library/Application\ Support/Google/Chrome/Default/Pepper\ Data/Shockwave\ Flash/CacheWritableAdobeRoot/AssetCache/*

I confirmed that reverting to the V1 sandbox allows the video to play. Now I will diagnose what sandbox rule needs to be added to the V2 profile and submit that.

From the flash process, likely the issue:

Sandbox: Google Chrome He(1515) deny mach-lookup com.apple.windowserver.active
Sandbox Check by:    launchd(1)

Violation:       deny mach-lookup com.apple.windowserver.active 
MetaData: {"build":"Mac OS X 10.13 (17A360a)","sandbox_checker":"launchd","action":"deny","target":["com.apple.windowserver.active"],"hardware":"Mac","platform_binary":"no","profile":"unknown","process":"Google Chrome He","op":"mach-lookup"}

Process:         Google Chrome He [1515]
Path:            /Applications/Google Chrome Canary.app/Contents/Versions/71.0.3570.0/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
Load Address:    0x10875f000
Identifier:      com.google.Chrome.helper
Version:         3570.0 (71.0.3570.0)
Code Type:       x86_64 (Native)
Parent Process:  Google Chrome Canary [1495]
Responsible:     /Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary [1495]
User ID:         501

Date/Time:       2018-10-04 14:03:07.750 PDT
OS Version:      Mac OS X 10.13 (17A360a)
Report Version:  8

Thread 0 (id: 187708, CrPPAPIMain):
0   libsystem_kernel.dylib        	0x00007fff6dfdae76 mach_msg_trap + 10
1   Google Chrome Framework       	0x000000011247043d
2   Google Chrome Framework       	0x0000000112436592
3   Google Chrome Framework       	0x0000000112459645
4   Google Chrome Framework       	0x0000000111f105e0
5   Google Chrome Framework       	0x0000000111fda661
6   Google Chrome Framework       	0x0000000113ce260d
7   Google Chrome Framework       	0x0000000111fd9a54
8   Google Chrome Framework       	0x000000010ff1725f ChromeMain + 175
9   Google Chrome Helper          	0x000000010875faee main + 494
10  libdyld.dylib                 	0x00007fff6de94145 start + 1
11  Google Chrome Helper          	0x000000000000000b

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cd1c7208c7266aefe80f964b93463a93a7bfc149

commit cd1c7208c7266aefe80f964b93463a93a7bfc149
Author: Greg Kerr <kerrnel@chromium.org>
Date: Fri Oct 05 16:52:58 2018

macOS V2 Sandbox: Allow PPAPI to contact window server.

Flash player DRM videos are currently broken because the V2 sandbox
blocks access to the window server. This allows the access.

Bug:  891823 
Change-Id: I06116f1de78480fe80b01465a6b9b097066b7278
Reviewed-on: https://chromium-review.googlesource.com/c/1263282
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Greg Kerr <kerrnel@chromium.org>
Cr-Commit-Position: refs/heads/master@{#597169}
[modify] https://crrev.com/cd1c7208c7266aefe80f964b93463a93a7bfc149/services/service_manager/sandbox/mac/ppapi_v2.sb

Ankur, can you please verify this in a canary build early next week? Then I'll consider a merge to beta. Thanks again for the report.

Thank you, Greg. I have verified it on canary version 71.0.3572.0. The issue is fixed. Please go ahead with the merge.