Initialize NSS with no DB in the renderer process

base/nss_util.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_NSS_UTIL_H_
 #define BASE_NSS_UTIL_H_
 #pragma once
 
 #include "base/basictypes.h"
 
@@ skipping 19 matching lines @@
 // Initialize NRPR if it isn't already initialized.  This function is
 // thread-safe, and NSPR will only ever be initialized once.  NSPR will be
 // properly shut down on program exit.
 void EnsureNSPRInit();
 
 // Initialize NSS if it isn't already initialized.  This must be called before
 // any other NSS functions.  This function is thread-safe, and NSS will only
 // ever be initialized once.  NSS will be properly shut down on program exit.
 void EnsureNSSInit();
 
+// Call this before calling EnsureNSSInit() will force NSS to initialize
+// without a persistent DB.  This is used for the special case where access of
+// persistent DB is prohibited.

[wtc, 2011/03/15 21:37:20]

Please document that this function is applicable to the
USE_NSS case only.  On Mac and Windows, NSS is always
initialized without a persistent DB.

+//
+// NSS will be initialized without loading any user security modules, including
+// the built-in root certificates module. User security modules need to be
+// loaded manually after NSS initialization.

[wtc, 2011/03/15 21:37:20]

I still think omitting the InitDefaultRootCerts call
is a non-obvious side effect of ForceNSSNoDBInit().

If you really do not want to load the default root certs
on Linux, it may be better to add a DisableDefaultRootCerts
function.

+//
+// If EnsureNSSInit() is called before then this function has no effect.
+//
+// WARNING: Use this with caution.
+void ForceNSSNoDBInit();
+
+// This methods is used to disable checks in NSS when used in a forked process.
+// NSS is fork-sensitive to avoid problems when using user security modules in

[wtc, 2011/03/15 21:37:20]

Nit: what does "fork-sensitive" mean?  Please reword this
comment.

+// a forked process.  However if we are sure there are no modules loaded before
+// the process is forked then there is no harm disabling the check.
+//
+// This method must be called before EnsureNSSInit() to take effect.
+//
+// WARNING: Use this with caution.
+void DisableNSSForkCheck();
+
 // Check if the current NSS version is greater than or equals to |version|.
 // A sample version string is "3.12.3".
 bool CheckNSSVersion(const char* version);
 
 #if defined(OS_CHROMEOS)
 // Open the r/w nssdb that's stored inside the user's encrypted home directory.
 void OpenPersistentNSSDB();
 #endif
 
 // Convert a NSS PRTime value into a base::Time object.
@@ skipping 26 matching lines @@
  private:
   Lock *lock_;
   DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock);
 };
 
 #endif  // defined(USE_NSS)
 
 }  // namespace base
 
 #endif  // BASE_NSS_UTIL_H_