Disable the seccomp filter GPU process sandbox by default on Chrome OS.

content/public/common/content_switches.cc

Index: content/public/common/content_switches.cc
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index 5d1aeab7ae3456686a64df3dfd6ef11c471691c7..07130f82bdf1f172dcdf106502b68bcf1130fca8 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -183,6 +183,9 @@ const char kDisableSeccompSandbox[]         = "disable-seccomp-sandbox";
 // Disable the seccomp filter sandbox (Linux only)
 const char kDisableSeccompFilterSandbox[]   = "disable-seccomp-filter-sandbox";
 
+// Enable the seccomp filter sandbox for the GPU process (Chrome OS only)
+const char kEnableChromeOSGPUSandbox[]      = "enable-chromeos-gpu-sandbox";

[Chris Evans, 2012/06/07 23:11:34]

I think this flag should be more generic, i.e. "enable-gpu-sandbox". In the
future, there might be more cases it is useful to cover (e.g. if we end up
disabling GPU sandbox for Nvidia Linux binary driver by default)

It'd also be nice if this forced on the GPU sandbox for non-Intel chipsets on
ChromeOS. We could perhaps predicate such behaviour as ifdef DEBUG to begin
with?

[Jorge Lucangeli Obes, 2012/06/08 00:15:24]

Changed flag name, but I'm wary about using the flag to enable on non-Intel
chipsets as well. We really have no way to preemptively test the devices that
might come along, and people might run a regular Chrome OS image (with the flag)
on them.

+
 // Disable session storage.
 const char kDisableSessionStorage[]         = "disable-session-storage";