Initialize NSS with no DB in the renderer process

base/nss_util.h

Index: base/nss_util.h
diff --git a/base/nss_util.h b/base/nss_util.h
index 10bbdfb41eb734f6f80ab104cf45cb87cb5fcd53..50623661a8eef1ab0025c42b2ae080dbfb89de38 100644
--- a/base/nss_util.h
+++ b/base/nss_util.h
@@ -37,6 +37,29 @@ void EnsureNSPRInit();
 // ever be initialized once.  NSS will be properly shut down on program exit.
 void EnsureNSSInit();
 
+// Call this before calling EnsureNSSInit() will force NSS to initialize
+// without a persistent DB.  This is used for the special case where access of
+// persistent DB is prohibited.

[wtc, 2011/03/15 21:37:20]

Please document that this function is applicable to the
USE_NSS case only.  On Mac and Windows, NSS is always
initialized without a persistent DB.

+//
+// NSS will be initialized without loading any user security modules, including
+// the built-in root certificates module. User security modules need to be
+// loaded manually after NSS initialization.

[wtc, 2011/03/15 21:37:20]

I still think omitting the InitDefaultRootCerts call
is a non-obvious side effect of ForceNSSNoDBInit().

If you really do not want to load the default root certs
on Linux, it may be better to add a DisableDefaultRootCerts
function.

+//
+// If EnsureNSSInit() is called before then this function has no effect.
+//
+// WARNING: Use this with caution.
+void ForceNSSNoDBInit();
+
+// This methods is used to disable checks in NSS when used in a forked process.
+// NSS is fork-sensitive to avoid problems when using user security modules in

[wtc, 2011/03/15 21:37:20]

Nit: what does "fork-sensitive" mean?  Please reword this
comment.

+// a forked process.  However if we are sure there are no modules loaded before
+// the process is forked then there is no harm disabling the check.
+//
+// This method must be called before EnsureNSSInit() to take effect.
+//
+// WARNING: Use this with caution.
+void DisableNSSForkCheck();
+
 // Check if the current NSS version is greater than or equals to |version|.
 // A sample version string is "3.12.3".
 bool CheckNSSVersion(const char* version);