Linux Sandbox: add resource limits to NaCl

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_NACL_LOADER_SANDBOX_LINUX_NACL_SANDBOX_LINUX_H_
 #define COMPONENTS_NACL_LOADER_SANDBOX_LINUX_NACL_SANDBOX_LINUX_H_
 
 #include "base/files/scoped_file.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 32 matching lines @@
   // layer-2 sandbox is not engaged.
   bool IsSingleThreaded();
   // Check whether the current process owns any directory file descriptors. This
   // will ignore any directory file descriptor owned by this object (i.e. those
   // that will be closed after SealLayerOneSandbox()) is called.
   // This API will only work if the layer-1 sandbox is not sealed and the
   // layer-2 sandbox is not engaged.
   bool HasOpenDirectory();
   // Will attempt to initialize the layer-1 sandbox, depending on flags and the
   // environment. It can only succeed if the current process is a child of the
-  // setuid sandbox.
+  // setuid sandbox or was started by the namespace sandbox.
   void InitializeLayerOneSandbox();
   // Will attempt to initialize the layer-2 sandbox, depending on flags and the
   // environment. |uses_nonsfi_mode| describes which seccomp-bpf policy is
   // appropriate.
+  // This layer will also add a limit to how much of the address space can be
+  // used.
   void InitializeLayerTwoSandbox(bool uses_nonsfi_mode);
   // Seal the layer-1 sandbox, making it enforcing.
   void SealLayerOneSandbox();
   // Check that the current sandboxing state matches the level of sandboxing
   // expected for NaCl in the current configuration. Crash if it does not.
   void CheckSandboxingStateWithPolicy();
 
   bool layer_one_enabled() { return layer_one_enabled_; }
   bool layer_two_enabled() { return layer_two_enabled_; }
 
  private:
   void CheckForExpectedNumberOfOpenFds();
 
   bool layer_one_enabled_;
   bool layer_one_sealed_;
   bool layer_two_enabled_;
   bool layer_two_is_nonsfi_;
   // |proc_fd_| must be released before the layer-1 sandbox is considered
   // enforcing.
   base::ScopedFD proc_fd_;
   scoped_ptr<sandbox::SetuidSandboxClient> setuid_sandbox_client_;
   DISALLOW_COPY_AND_ASSIGN(NaClSandbox);
 };
 
 }  // namespace nacl
 
 #endif  // COMPONENTS_NACL_LOADER_SANDBOX_LINUX_NACL_SANDBOX_LINUX_H_