Disable the seccomp filter GPU process sandbox by default on Chrome OS.

content/gpu/gpu_main.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 
 #if defined(OS_WIN)
 #include <windows.h>
 #endif
 
@@ skipping 121 matching lines @@
   {
     TRACE_EVENT0("gpu", "Warm up HMAC");
     // Warm up the crypto subsystem, which needs to done pre-sandbox on all
     // platforms.
     crypto::HMAC hmac(crypto::HMAC::SHA256);
     unsigned char key = '\0';
     bool ret = hmac.Init(&key, sizeof(key));
     (void) ret;
   }
 
-#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+#if defined(OS_LINUX)
   {
     TRACE_EVENT0("gpu", "Initialize sandbox");
-    content::InitializeSandbox();
+    bool do_init_sandbox = true;
+
+#if defined(OS_CHROMEOS)

[Chris Evans, 2012/06/08 07:13:57]

I think we can have the best of two worlds:
- never accidentally turn it on for non-intel in production
- enable debug builds to play with turning on sandbox for non-intel

This could be achieved by adding && !defined(DEBUG) to your conditional I think?

[Jorge Lucangeli Obes, 2012/06/11 20:23:04]

Done.

+    // On Chrome OS, initialize the GPU process' sandbox only on Intel GPUs.
+    do_init_sandbox = gpu_info.gpu.vendor_id == 0x8086;   // Intel GPU.
+#endif
+
+    if (do_init_sandbox) {
+      content::InitializeSandbox();
+    }
   }
 #endif
 
   {
     TRACE_EVENT0("gpu", "Initialize COM");
     base::win::ScopedCOMInitializer com_initializer;
   }
 
 #if defined(OS_WIN)
   {
@@ skipping 48 matching lines @@
 
   {
     TRACE_EVENT0("gpu", "Run Message Loop");
     main_message_loop.Run();
   }
 
   child_thread->StopWatchdog();
 
   return 0;
 }