services/shell: Turn on sandboxing for mojo apps.

chrome/app/mash/mash_runner.cc

Index: chrome/app/mash/mash_runner.cc
diff --git a/chrome/app/mash/mash_runner.cc b/chrome/app/mash/mash_runner.cc
index 78d14daa6f318860186021870f1044fe0473144a..862a776defbfeb1d30b7c0b1514f564c5c8d3c63 100644
--- a/chrome/app/mash/mash_runner.cc
+++ b/chrome/app/mash/mash_runner.cc
@@ -73,6 +73,14 @@ class NativeRunnerDelegateImpl : public shell::NativeRunnerDelegate {
 #if defined(OS_WIN)
       command_line->AppendArg(switches::kPrefetchArgumentOther);
 #endif
+      if (target.instance() == "font_service" || target.instance() == "ui") {
+        base::CommandLine::StringVector argv(command_line->argv());
+        auto iter = std::find(argv.begin(), argv.end(),
+                              FILE_PATH_LITERAL("--enable-sandbox"));
+        if (iter != argv.end())
+          argv.erase(iter);
+        *command_line = base::CommandLine(argv);
+      }
       return;
     }