Share the zygote's fopen overrides with nacl_helper.

chrome/nacl/nacl_helper_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A mini-zygote specifically for Native Client.
 
 #include "chrome/common/nacl_helper_linux.h"
 
 #include <errno.h>
 #include <link.h>
@@ skipping 11 matching lines @@
 #include "base/global_descriptors_posix.h"
 #include "base/json/string_escape.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/posix/unix_domain_socket.h"
 #include "base/rand_util.h"
 #include "chrome/nacl/nacl_listener.h"
 #include "crypto/nss_util.h"
 #include "ipc/ipc_descriptors.h"
 #include "ipc/ipc_switches.h"
+#include "sandbox/linux/services/libc_urandom_override.h"
 
 namespace {
 
 // The child must mimic the behavior of zygote_main_linux.cc on the child
 // side of the fork. See zygote_main_linux.cc:HandleForkRequest from
 //   if (!child) {
 // Note: this code doesn't attempt to support SELINUX or the SECCOMP sandbox.
 void BecomeNaClLoader(const std::vector<int>& child_fds,
                       size_t prereserved_sandbox_size) {
   VLOG(1) << "NaCl loader: setting up IPC descriptor";
@@ skipping 152 matching lines @@
       LOG(ERROR) << "Could not parse reserved_at_zero argument value of "
                  << reserved_at_zero_switch_value;
   }
   return prereserved_sandbox_size;
 }
 
 int main(int argc, char *argv[]) {
   CommandLine::Init(argc, argv);
   base::AtExitManager exit_manager;
   base::RandUint64();  // acquire /dev/urandom fd before sandbox is raised
+#if !defined(CHROMIUM_SELINUX)
+  // Allows NSS to fopen() /dev/urandom.
+  sandbox::InitLibcUrandomOverrides();
+#endif
 #if defined(USE_NSS)
   // Configure NSS for use inside the NaCl process.
   // The fork check has not caused problems for NaCl, but this appears to be
   // best practice (see other places LoadNSSLibraries is called.)
   crypto::DisableNSSForkCheck();
   // Without this line on Linux, HMAC::Init will instantiate a singleton that
   // in turn attempts to open a file.  Disabling this behavior avoids a ~70 ms
   // stall the first time HMAC is used.
   crypto::ForceNSSNoDBInit();
   // Load shared libraries before sandbox is raised.
@@ skipping 40 matching lines @@
       _exit(-1);
     }
     // if fork fails, send PID=-1 to zygote
     if (!UnixDomainSocket::SendMsg(kNaClZygoteDescriptor, &badpid,
                                    sizeof(badpid), empty)) {
       LOG(ERROR) << "*** send() to zygote failed";
     }
   }
   CHECK(false);  // This routine must not return
 }