linux: enable seccomp sandbox by default

chrome/browser/zygote_host_linux.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/zygote_host_linux.h"
 
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/command_line.h"
 #include "base/eintr_wrapper.h"
 #include "base/linux_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/process_util.h"
 #include "base/string_util.h"
 #include "base/unix_domain_socket_posix.h"
 
 #include "chrome/browser/renderer_host/render_sandbox_host_linux.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/process_watcher.h"
 
-#include "sandbox/linux/suid/suid_unsafe_environment_variables.h"
-
-static void SaveSUIDUnsafeEnvironmentVariables() {
-  // The ELF loader will clear many environment variables so we save them to
-  // different names here so that the SUID sandbox can resolve them for the
-  // renderer.
-
-  for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) {
-    const char* const envvar = kSUIDUnsafeEnvironmentVariables[i];
-    char* const saved_envvar = SandboxSavedEnvironmentVariable(envvar);
-    if (!saved_envvar)
-      continue;
-
-    const char* const value = getenv(envvar);
-    if (value)
-      setenv(saved_envvar, value, 1 /* overwrite */);
-    else
-      unsetenv(saved_envvar);
-
-    free(saved_envvar);
-  }
-}
-
 ZygoteHost::ZygoteHost()
     : pid_(-1),
       init_(false),
       using_suid_sandbox_(false) {
 }
 
 ZygoteHost::~ZygoteHost() {
   if (init_)
     close(control_fd_);
 }
@@ skipping 30 matching lines @@
     cmd_line.AppendSwitchWithValue(switches::kLoggingLevel,
                                    browser_command_line.GetSwitchValueASCII(
                                        switches::kLoggingLevel));
   }
   if (browser_command_line.HasSwitch(switches::kEnableLogging)) {
     // Append with value to support --enable-logging=stderr.
     cmd_line.AppendSwitchWithValue(switches::kEnableLogging,
                                    browser_command_line.GetSwitchValueASCII(
                                        switches::kEnableLogging));
   }
-  if (browser_command_line.HasSwitch(switches::kEnableSeccompSandbox)) {
-    cmd_line.AppendSwitch(switches::kEnableSeccompSandbox);
+  if (browser_command_line.HasSwitch(switches::kDisableSeccompSandbox)) {
+    cmd_line.AppendSwitch(switches::kDisableSeccompSandbox);
   }
 
   sandbox_binary_ = sandbox_cmd.c_str();
-  struct stat st;
-
-  if (!sandbox_cmd.empty() && stat(sandbox_binary_.c_str(), &st) == 0) {
-    if (access(sandbox_binary_.c_str(), X_OK) == 0 &&
-        (st.st_uid == 0) &&
-        (st.st_mode & S_ISUID) &&
-        (st.st_mode & S_IXOTH)) {
-      using_suid_sandbox_ = true;
-      cmd_line.PrependWrapper(ASCIIToWide(sandbox_binary_.c_str()));
-
-      SaveSUIDUnsafeEnvironmentVariables();
-    } else {
-      LOG(FATAL) << "The SUID sandbox helper binary was found, but is not "
-                    "configured correctly. Rather than run without sandboxing "
-                    "I'm aborting now. You need to make sure that "
-                 << sandbox_binary_ << " is mode 4755 and owned by root.";
-    }
-  }
 
   // Start up the sandbox host process and get the file descriptor for the
   // renderers to talk to it.
   const int sfd = Singleton<RenderSandboxHostLinux>()->GetRendererSocket();
   fds_to_map.push_back(std::make_pair(sfd, 5));
 
   int dummy_fd = -1;
   if (using_suid_sandbox_) {
     dummy_fd = socket(PF_UNIX, SOCK_DGRAM, 0);
     CHECK(dummy_fd >= 0);
@@ skipping 135 matching lines @@
       !read_pickle.ReadBool(&iter, &tmp_child_exited)) {
     LOG(WARNING) << "Error parsing DidProcessCrash response from zygote.";
     return false;
   }
 
   if (child_exited)
     *child_exited = tmp_child_exited;
 
   return did_crash;
 }