Zygote: Initialize NSS fully

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
@@ skipping 472 matching lines @@
   }
 
   if (setuid_sandbox->IsInNewPIDNamespace() && !has_started_new_init) {
     LOG(ERROR) << "The SUID sandbox created a new PID namespace but Zygote "
                   "is not the init process. Please, make sure the SUID "
                   "binary is up to date.";
   }
 
   int sandbox_flags = linux_sandbox->GetStatus();
 
+#if defined(USE_NSS)
+  // Initialize NSS. We don't want to do this pre-sandbox because it's not well
+  // defined what venues of attacks it could create.
+  //
+  // In addition to the benfit of doing this initialization only once, (it will
+  // be inherited), this is a good warm-up before we enable our next layer of
+  // sandbox, e.g. seccomp-bpf.
+
+  // We will soon fork, but we haven't loaded any security module.
+  crypto::DisableNSSForkCheck();
+  // The setuid sandbox would prevent opening user security modules anyway,
+  // but it's more correct to tell NSS to not do it.
+  // Loading user security modules would have security implications.
+  crypto::ForceNSSNoDBInit();
+  // Initialize NSS, every child process will benefit from it.
+  crypto::EnsureNSSInit();
+#endif
+
   Zygote zygote(sandbox_flags, forkdelegate);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content