Load additional NSS library files in zygote main if remoting is enabled

content/browser/zygote_main_linux.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <sys/epoll.h>
 #include <sys/prctl.h>
 #include <sys/signal.h>
@@ skipping 583 matching lines @@
   // ICU DateFormat class (used in base/time_format.cc) needs to get the
   // Olson timezone ID by accessing the zoneinfo files on disk. After
   // TimeZone::createDefault is called once here, the timezone ID is
   // cached and there's no more need to access the file system.
   scoped_ptr<icu::TimeZone> zone(icu::TimeZone::createDefault());
 
   FilePath module_path;
   if (PathService::Get(base::DIR_MODULE, &module_path))
     media::InitializeMediaLibrary(module_path);
 
-  // Remoting requires NSS to function properly. It is not used for other
-  // reasons so load NSS only if remoting is enabled.
-  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kEnableRemoting)) {
-    // We are going to fork to engage the sandbox and we have not loaded
-    // any security modules so it is safe to disable the fork check in NSS.
-    base::DisableNSSForkCheck();
-
-    // Initialize NSS so that we load the necessary library files
-    // before we enter the sandbox.
-    base::ForceNSSNoDBInit();
-    base::EnsureNSSInit();
-  }
+  // NSS libraries are loaded before sandbox is activated. This is to allow
+  // successful initialization of NSS which tries to load extra library files.
+  // Doing so will allow NSS to be used within sandbox for chromoting.
+#if defined(USE_NSS)
+  base::LoadNSSLibraries();
+#endif
 
   // Ensure access to the Pepper plugins before the sandbox is turned on.
   PepperPluginRegistry::PreloadModules();
 }
 
 #if !defined(CHROMIUM_SELINUX)
 static bool EnterSandbox() {
   // The SUID sandbox sets this environment variable to a file descriptor
   // over which we can signal that we have completed our startup and can be
   // chrooted.
@@ skipping 135 matching lines @@
       VLOG(1) << "Enabling experimental Seccomp sandbox.";
       sandbox_flags |= ZygoteHost::kSandboxSeccomp;
     }
   }
 #endif  // SECCOMP_SANDBOX
 
   Zygote zygote(sandbox_flags);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }