Linux: add a seccomp-bpf sandbox for renderers

content/common/sandbox_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
 #include "base/command_line.h"
 #include "base/eintr_wrapper.h"
@@ skipping 140 matching lines @@
 int LinuxSandbox::GetStatus() const {
   CHECK(pre_initialized_);
   int sandbox_flags = 0;
   if (setuid_sandbox_client_->IsSandboxed()) {
     sandbox_flags |= kSandboxLinuxSUID;
     if (setuid_sandbox_client_->IsInNewPIDNamespace())
       sandbox_flags |= kSandboxLinuxPIDNS;
     if (setuid_sandbox_client_->IsInNewNETNamespace())
       sandbox_flags |= kSandboxLinuxNetNS;
   }
-  if (seccomp_legacy_supported() &&
-      ShouldEnableSeccompLegacy(switches::kRendererProcess)) {
+
+  if (seccomp_bpf_supported() &&
+      SandboxSeccompBpf::ShouldEnableSeccompBpf(switches::kRendererProcess)) {
     // We report whether the sandbox will be activated when renderers go
     // through sandbox initialization.
+    sandbox_flags |= kSandboxLinuxSeccompBpf;
+  }
+
+  // We only try to enable seccomp-legacy when seccomp-bpf is not supported
+  // or not enabled.
+  if (!(sandbox_flags & kSandboxLinuxSeccompBpf) &&
+      seccomp_legacy_supported() &&
+      ShouldEnableSeccompLegacy(switches::kRendererProcess)) {
+    // Same here, what we report is what we will do for the renderer.
     sandbox_flags |= kSandboxLinuxSeccompLegacy;
   }
-  if (seccomp_bpf_supported() &&
-      SandboxSeccompBpf::ShouldEnableSeccompBpf(switches::kRendererProcess)) {
-    // Same here, what we report is what we will do for the renderer.
-    sandbox_flags |= kSandboxLinuxSeccompBpf;
-  }
   return sandbox_flags;
 }
 
 bool LinuxSandbox::IsSingleThreaded() const {
   // TODO(jln): re-implement this properly and use our proc_fd_ if available.
   // Possibly racy, but it's ok because this is more of a debug check to catch
   // new threaded situations arising during development.
   int num_threads = file_util::CountFilesCreatedAfter(
       FilePath("/proc/self/task"),
       base::Time::UnixEpoch());
@@ skipping 46 matching lines @@
   return seccomp_legacy_supported_;
 }
 
 bool LinuxSandbox::seccomp_bpf_supported() const {
   CHECK(pre_initialized_);
   return seccomp_bpf_supported_;
 }
 
 }  // namespace content