Disable the seccomp filter GPU process sandbox by default on Chrome OS.

content/gpu/gpu_main.cc

Index: content/gpu/gpu_main.cc
diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
index 27caaa0bbdadb780813b0e71778b1279816180ce..2afbe974a5db0646cffa5acf17284c69597738ce 100644
--- a/content/gpu/gpu_main.cc
+++ b/content/gpu/gpu_main.cc
@@ -139,10 +139,19 @@ int GpuMain(const content::MainFunctionParams& parameters) {
     (void) ret;
   }
 
-#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+#if defined(OS_LINUX)
   {
     TRACE_EVENT0("gpu", "Initialize sandbox");
-    content::InitializeSandbox();
+    bool do_init_sandbox = true;
+
+#if defined(OS_CHROMEOS)

[Chris Evans, 2012/06/08 07:13:57]

I think we can have the best of two worlds:
- never accidentally turn it on for non-intel in production
- enable debug builds to play with turning on sandbox for non-intel

This could be achieved by adding && !defined(DEBUG) to your conditional I think?

[Jorge Lucangeli Obes, 2012/06/11 20:23:04]

Done.

+    // On Chrome OS, initialize the GPU process' sandbox only on Intel GPUs.
+    do_init_sandbox = gpu_info.gpu.vendor_id == 0x8086;   // Intel GPU.
+#endif
+
+    if (do_init_sandbox) {
+      content::InitializeSandbox();
+    }
   }
 #endif