Load additional NSS library files in zygote main if remoting is enabled

content/browser/zygote_main_linux.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <sys/epoll.h>
 #include <sys/prctl.h>
 #include <sys/signal.h>
@@ skipping 583 matching lines @@
   // ICU DateFormat class (used in base/time_format.cc) needs to get the
   // Olson timezone ID by accessing the zoneinfo files on disk. After
   // TimeZone::createDefault is called once here, the timezone ID is
   // cached and there's no more need to access the file system.
   scoped_ptr<icu::TimeZone> zone(icu::TimeZone::createDefault());
 
   FilePath module_path;
   if (PathService::Get(base::DIR_MODULE, &module_path))
     media::InitializeMediaLibrary(module_path);
 
-  // Remoting requires NSS to function properly. It is not used for other
-  // reasons so load NSS only if remoting is enabled.
-  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kEnableRemoting)) {
-    // We are going to fork to engage the sandbox and we have not loaded
-    // any security modules so it is safe to disable the fork check in NSS.
-    base::DisableNSSForkCheck();
-
-    // Initialize NSS so that we load the necessary library files
-    // before we enter the sandbox.
-    base::ForceNSSNoDBInit();
-    base::EnsureNSSInit();
-  }
+  // Remoting requires NSS to function properly.
+  base::LoadNSSLibraries();

[wtc, 2011/03/17 20:03:55]

IMPORTANT: why don't you need to disable the NSS fork checks
and force NSS NoDB init now?

The comment is not useful to someone who doesn't know the
issues involved with initializing NSS inside a sandbox.
Please improve the comment, for example, (copied from old code)
  Load the necessary library files so that we can initialize
  NSS after we enter the sandbox.

[Alpha Left Google, 2011/03/17 22:31:34]

Because we want to initalize only in the renderer process but not in the zygote
process. Also disable fork check needs to be done in the renderer process.

[wtc, 2011/03/18 18:46:31]

Did you mean the renderer process cannot load any libraries,
even before the sandbox is activated?

[Alpha Left Google, 2011/03/18 18:49:12]

When the renderer process starts (it is forked from the zygote process), it
cannot load any libraries already. So the way it works is to load the libs in
the zygote process and then fork.

Because of this, anywhere inside the renderer process we can initialize NSS
safely and doesn't need to be done here.

 
   // Ensure access to the Pepper plugins before the sandbox is turned on.
   PepperPluginRegistry::PreloadModules();
 }
 
 #if !defined(CHROMIUM_SELINUX)
 static bool EnterSandbox() {
   // The SUID sandbox sets this environment variable to a file descriptor
   // over which we can signal that we have completed our startup and can be
   // chrooted.
@@ skipping 135 matching lines @@
       VLOG(1) << "Enabling experimental Seccomp sandbox.";
       sandbox_flags |= ZygoteHost::kSandboxSeccomp;
     }
   }
 #endif  // SECCOMP_SANDBOX
 
   Zygote zygote(sandbox_flags);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }