Disable the seccomp filter GPU process sandbox by default on Chrome OS.

content/common/sandbox_init_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/sandbox_init.h"
 
 #if defined(OS_LINUX) && defined(__x86_64__)
 
 #include <asm/unistd.h>
 #include <errno.h>
@@ skipping 370 matching lines @@
   PLOG_IF(FATAL, ret != 0) << "prctl(PR_SET_NO_NEW_PRIVS) failed";
 
   struct sock_fprog fprog;
   fprog.len = program.size();
   fprog.filter = const_cast<struct sock_filter*>(&program[0]);
 
   ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &fprog, 0, 0);
   PLOG_IF(FATAL, ret != 0) << "Failed to install filter.";
 }
 
+static bool ShouldEnableGPUSandbox() {
+#if defined(OS_CHROMEOS)
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  return command_line.HasSwitch(switches::kEnableGPUSandbox);
+#else
+  return true;

[Chris Evans, 2012/06/08 07:13:57]

return !command_line.HasSwitch(kDisable) -- see below.

[Jorge Lucangeli Obes, 2012/06/11 20:23:04]

Done.

+#endif
+}
+
 }  // anonymous namespace
 
 namespace content {
 
 void InitializeSandbox() {
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kNoSandbox) ||
       command_line.HasSwitch(switches::kDisableSeccompFilterSandbox))
     return;
 
   std::string process_type =
       command_line.GetSwitchValueASCII(switches::kProcessType);
   if (process_type == switches::kGpuProcess &&
       command_line.HasSwitch(switches::kDisableGpuSandbox))

[Chris Evans, 2012/06/08 07:13:57]

Do it here (see below :P )
Keep your separate function, as the logic for enable vs. disable GPU sandbox is
no longer trivial. Move the check for kDisableGpuSandbox into your new function.

     return;
 
   if (!CanUseSeccompFilters())
     return;
 
   CheckSingleThreaded();
 
   std::vector<struct sock_filter> program;
   EmitPreamble(&program);
 
-  if (process_type == switches::kGpuProcess) {
+  if (process_type == switches::kGpuProcess &&
+      ShouldEnableGPUSandbox()) {

[Chris Evans, 2012/06/08 07:13:57]

You want to do it above, otherwise you'll crash into NOTREACHED I think.

[Jorge Lucangeli Obes, 2012/06/11 20:23:04]

Done.

     ApplyGPUPolicy(&program);
     EmitTrap(&program);  // Default deny.
   } else if (process_type == switches::kPpapiPluginProcess) {
     ApplyFlashPolicy(&program);
     EmitTrap(&program);  // Default deny.
   } else if (process_type == switches::kRendererProcess ||
              process_type == switches::kWorkerProcess) {
     ApplyNoPtracePolicy(&program);
     EmitAllow(&program);  // Default permit.
   } else {
     NOTREACHED();
   }
 
   InstallSIGSYSHandler();
   InstallFilter(program);
 }
 
 }  // namespace content
 
 #else
 
 namespace content {
 
 void InitializeSandbox() {
 }
 
 }  // namespace content
 
 #endif
-