Block ptrace (and ptrace-like) syscalls from the renderer and worker processs.

content/worker/worker_main.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/string_util.h"
 #include "base/system_monitor/system_monitor.h"
 #include "base/threading/platform_thread.h"
 #include "content/common/child_process.h"
 #include "content/common/hi_res_timer_manager.h"
 #include "content/public/common/main_function_params.h"
+#include "content/public/common/sandbox_init.h"
 #include "content/worker/worker_thread.h"
 
 #if defined(OS_WIN)
-#include "content/public/common/sandbox_init.h"
 #include "sandbox/src/sandbox.h"
 #endif
 
 // Mainline routine for running as the worker process.
 int WorkerMain(const content::MainFunctionParams& parameters) {
   // The main message loop of the worker process.
   MessageLoop main_message_loop;
   base::PlatformThread::SetName("CrWorkerMain");
 
   base::SystemMonitor system_monitor;
@@ skipping 10 matching lines @@
   // Cause advapi32 to load before the sandbox is turned on.
   unsigned int dummy_rand;
   rand_s(&dummy_rand);
   // Warm up language subsystems before the sandbox is turned on.
   ::GetUserDefaultLangID();
   ::GetUserDefaultLCID();
 
   target_services->LowerToken();
 #endif
 
+#if defined(OS_LINUX)
+  content::InitializeSandbox();
+#endif
+
   const CommandLine& parsed_command_line = parameters.command_line;
   if (parsed_command_line.HasSwitch(switches::kWaitForDebugger)) {
     ChildProcess::WaitForDebugger("Worker");
   }
 
   // Load the accelerator table from the browser executable and tell the
   // message loop to use it when translating messages.
   MessageLoop::current()->Run();
 
   return 0;
 }