Linux: add a seccomp-bpf sandbox for renderers

content/common/sandbox_init_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "content/common/sandbox_linux.h"
 #include "content/public/common/content_switches.h"
@@ skipping 15 matching lines @@
   // threads have been created.
   if (!linux_sandbox->IsSingleThreaded()) {
     std::string error_message = "InitializeSandbox() called with multiple "
                                 "threads in process " + process_type;
     // TODO(jln): change this into a CHECK() once we are more comfortable it
     // does not trigger.
     LOG(ERROR) << error_message;
     return false;
   }
 
-  // First, try to enable seccomp-legacy.
-  seccomp_legacy_started = linux_sandbox->StartSeccompLegacy(process_type);
+  // First, try to enable seccomp-bpf.
+  seccomp_bpf_started = linux_sandbox->StartSeccompBpf(process_type);
 
-  // Then, try to enable seccomp-bpf.
-  // If seccomp-legacy is enabled, seccomp-bpf initialization will crash
-  // instead of failing gracefully.
-  // TODO(markus): fix this (crbug.com/139872).
-  if (!seccomp_legacy_started) {
-    seccomp_bpf_started = linux_sandbox->StartSeccompBpf(process_type);
+  // If that fails, try to enable seccomp-legacy.
+  if (!seccomp_bpf_started) {
+    seccomp_legacy_started = linux_sandbox->StartSeccompLegacy(process_type);
   }
 
   return seccomp_legacy_started || seccomp_bpf_started;
 }
 
 }  // namespace content