Clean up GPU process seccomp-bpf sandbox policies.

content/common/sandbox_seccomp_bpf_linux.cc

Index: content/common/sandbox_seccomp_bpf_linux.cc
diff --git a/content/common/sandbox_seccomp_bpf_linux.cc b/content/common/sandbox_seccomp_bpf_linux.cc
index 5e694f7a29abb263b2155bcc7df231dc512e2394..518aeabcc3b4b5e57a3f1de6d3f6a81e5ec7f3cc 100644
--- a/content/common/sandbox_seccomp_bpf_linux.cc
+++ b/content/common/sandbox_seccomp_bpf_linux.cc
@@ -427,25 +427,8 @@ void WarmupPolicy(playground2::Sandbox::EvaluateSyscall policy) {
 // Is the sandbox fully disabled for this process?
 bool ShouldDisableBpfSandbox(const CommandLine& command_line,
                              const std::string& process_type) {
-  if (process_type == switches::kGpuProcess) {
-    // The GPU sandbox is disabled by default in ChromeOS, enabled by default on
-    // generic Linux.
-    // TODO(jorgelo): when we feel comfortable, make this a policy decision
-    // instead. (i.e. move this to GetProcessSyscallPolicy) and return an
-    // AllowAllPolicy for lack of "--enable-gpu-sandbox".
-    bool should_disable;
-    if (IsChromeOS()) {
-      should_disable = true;
-    } else {
-      should_disable = false;
-    }
-
-    if (command_line.HasSwitch(switches::kEnableGpuSandbox))
-      should_disable = false;
-    if (command_line.HasSwitch(switches::kDisableGpuSandbox))
-      should_disable = true;
-    return should_disable;
-  }
+  if (process_type == switches::kGpuProcess)
+    return command_line.HasSwitch(switches::kDisableGpuSandbox);

[jln (very slow on Chromium), 2012/08/06 21:36:50]

Also, could you kill this function and inline this in
SandboxSeccompBpf::ShouldEnableSeccompBpf() ?

 
   return false;
 }
@@ -455,7 +438,10 @@ playground2::Sandbox::EvaluateSyscall GetProcessSyscallPolicy(
     const std::string& process_type) {
 #if defined(__x86_64__)
   if (process_type == switches::kGpuProcess) {
-    return GpuProcessPolicy_x86_64;
+    if (command_line.HasSwitch(switches::kEnableGpuSandbox))
+      return GpuProcessPolicy_x86_64;
+    else
+      return AllowAllPolicy;
   }
 
   if (process_type == switches::kPpapiPluginProcess) {
@@ -472,8 +458,14 @@ playground2::Sandbox::EvaluateSyscall GetProcessSyscallPolicy(
   // This will be our default if we need one.
   return AllowAllPolicy;
 #else
+  if (process_type == switches::kGpuProcess) {
+    if (command_line.HasSwitch(switches::kEnableGpuSandbox))
+      return BlacklistPtracePolicy;
+    else
+      return AllowAllPolicy;
+  }
+
   // On IA32, we only have a small blacklist at the moment.
-  (void) process_type;
   return BlacklistPtracePolicy;
 #endif  // __x86_64__
 }