Initialize NSS in the PPAPI process for ClearKey CDM.

content/ppapi_plugin/ppapi_plugin_main.cc

Index: content/ppapi_plugin/ppapi_plugin_main.cc
diff --git a/content/ppapi_plugin/ppapi_plugin_main.cc b/content/ppapi_plugin/ppapi_plugin_main.cc
index 8e1515c1e954bf6bcb915a5874e0f90671263f29..b60b0c448ea911d79e77d45ffbe11fa070e42c67 100644
--- a/content/ppapi_plugin/ppapi_plugin_main.cc
+++ b/content/ppapi_plugin/ppapi_plugin_main.cc
@@ -8,6 +8,7 @@
 #include "base/message_loop.h"
 #include "base/threading/platform_thread.h"
 #include "build/build_config.h"
+#include "crypto/nss_util.h"
 #include "content/common/child_process.h"
 #include "content/ppapi_plugin/ppapi_thread.h"
 #include "content/public/common/content_switches.h"
@@ -78,6 +79,11 @@ int PpapiPluginMain(const MainFunctionParams& parameters) {
   MessageLoop main_message_loop;
   base::PlatformThread::SetName("CrPPAPIMain");
 
+#if defined(OS_LINUX) && defined(USE_NSS)
+  // Some out-of-process PPAPI plugins need access to NSS.
+  crypto::WarmUpNSSSafely();
+#endif
+
 #if defined(OS_LINUX)
   InitializeSandbox();

[Ryan Sleevi, 2012/11/15 19:48:02]

Just showing my own ignorance here:

This call initializes the seccomp-bpf sandbox, correct? The SUID sandbox is
already in place by the time the process gets here, by virtue of having forked
off the zygote, right?

[Jorge Lucangeli Obes, 2012/11/15 19:50:25]

Correct. There's no "initializing" the SUID sandbox per-se, just the Zygote
telling the helper binary to perform the chrooting, which happens in ZygoteMain.

 #endif