Disable the seccomp filter GPU process sandbox by default on Chrome OS.

content/common/sandbox_init_linux.cc

Index: content/common/sandbox_init_linux.cc
diff --git a/content/common/sandbox_init_linux.cc b/content/common/sandbox_init_linux.cc
index 1dd1554ff064ceaba55fdb10b49f07530b82a0e1..336c1736842485d0b3dc7df9f5f81601458fd44f 100644
--- a/content/common/sandbox_init_linux.cc
+++ b/content/common/sandbox_init_linux.cc
@@ -388,6 +388,15 @@ static void InstallFilter(const std::vector<struct sock_filter>& program) {
   PLOG_IF(FATAL, ret != 0) << "Failed to install filter.";
 }
 
+static bool ShouldEnableGPUSandbox() {
+#if defined(OS_CHROMEOS)
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  return command_line.HasSwitch(switches::kEnableGPUSandbox);
+#else
+  return true;

[Chris Evans, 2012/06/08 07:13:57]

return !command_line.HasSwitch(kDisable) -- see below.

[Jorge Lucangeli Obes, 2012/06/11 20:23:04]

Done.

+#endif
+}
+
 }  // anonymous namespace
 
 namespace content {
@@ -412,7 +421,8 @@ void InitializeSandbox() {
   std::vector<struct sock_filter> program;
   EmitPreamble(&program);
 
-  if (process_type == switches::kGpuProcess) {
+  if (process_type == switches::kGpuProcess &&
+      ShouldEnableGPUSandbox()) {

[Chris Evans, 2012/06/08 07:13:57]

You want to do it above, otherwise you'll crash into NOTREACHED I think.

[Jorge Lucangeli Obes, 2012/06/11 20:23:04]

Done.

     ApplyGPUPolicy(&program);
     EmitTrap(&program);  // Default deny.
   } else if (process_type == switches::kPpapiPluginProcess) {
@@ -442,4 +452,3 @@ void InitializeSandbox() {
 }  // namespace content
 
 #endif
-