Index: llvm/utils/gn/.gn
===================================================================
--- llvm/utils/gn/.gn
+++ llvm/utils/gn/.gn
@@ -6,7 +6,9 @@
 
 # Disallow all calls to exec_script. We should be very conservative about
 # whitelisting things here.
-exec_script_whitelist = []
+exec_script_whitelist = [
+  "//llvm/utils/gn/build/mac_sdk.gni",
+]
 
 # The normal GN setup is to have BUILD.gn files in-tree and a root BUILD.gn
 # file.  Since LLVM's GN build is unofficial, set secondary_source to tell GN
Index: llvm/utils/gn/build/mac_sdk.gni
===================================================================
--- llvm/utils/gn/build/mac_sdk.gni
+++ llvm/utils/gn/build/mac_sdk.gni
@@ -1,4 +1,2 @@
 # Location of the mac sdk.
-# If that's not fixed, might want to shell out to xcrun at gn time to
-# retrieve this, but for now this seems to do the trick.
-mac_sdk_path = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+mac_sdk_path = exec_script("mac_sdk.py", [], "string")
Index: llvm/utils/gn/build/mac_sdk.py
===================================================================
--- /dev/null
+++ llvm/utils/gn/build/mac_sdk.py
@@ -0,0 +1,7 @@
+#!/usr/bin/env python
+
+from __future__ import print_function
+
+import subprocess
+
+print(subprocess.check_output(['xcrun', '--show-sdk-path']).rstrip(), end='')