Load additional NSS library files in zygote main if remoting is enabled

content/browser/zygote_main_linux.cc

Index: content/browser/zygote_main_linux.cc
diff --git a/content/browser/zygote_main_linux.cc b/content/browser/zygote_main_linux.cc
index b56a8a05ef7c4170258f5a27ccac669c332e0c51..851efd6d579ab782c9e6afeaba35fe456ce35665 100644
--- a/content/browser/zygote_main_linux.cc
+++ b/content/browser/zygote_main_linux.cc
@@ -601,19 +601,8 @@ static void PreSandboxInit() {
   if (PathService::Get(base::DIR_MODULE, &module_path))
     media::InitializeMediaLibrary(module_path);
 
-  // Remoting requires NSS to function properly. It is not used for other
-  // reasons so load NSS only if remoting is enabled.
-  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kEnableRemoting)) {
-    // We are going to fork to engage the sandbox and we have not loaded
-    // any security modules so it is safe to disable the fork check in NSS.
-    base::DisableNSSForkCheck();
-
-    // Initialize NSS so that we load the necessary library files
-    // before we enter the sandbox.
-    base::ForceNSSNoDBInit();
-    base::EnsureNSSInit();
-  }
+  // Remoting requires NSS to function properly.
+  base::LoadNSSLibraries();

[wtc, 2011/03/17 20:03:55]

IMPORTANT: why don't you need to disable the NSS fork checks
and force NSS NoDB init now?

The comment is not useful to someone who doesn't know the
issues involved with initializing NSS inside a sandbox.
Please improve the comment, for example, (copied from old code)
  Load the necessary library files so that we can initialize
  NSS after we enter the sandbox.

[Alpha Left Google, 2011/03/17 22:31:34]

Because we want to initalize only in the renderer process but not in the zygote
process. Also disable fork check needs to be done in the renderer process.

[wtc, 2011/03/18 18:46:31]

Did you mean the renderer process cannot load any libraries,
even before the sandbox is activated?

[Alpha Left Google, 2011/03/18 18:49:12]

When the renderer process starts (it is forked from the zygote process), it
cannot load any libraries already. So the way it works is to load the libs in
the zygote process and then fork.

Because of this, anywhere inside the renderer process we can initialize NSS
safely and doesn't need to be done here.

 
   // Ensure access to the Pepper plugins before the sandbox is turned on.
   PepperPluginRegistry::PreloadModules();