Support running NaCl in Chromium's Linux SUID sandbox

Support running the NaCl plugin in Chromium's Linux SUID sandbox

 * Use pre-opened FD for /dev/urandom.
 * Use IPC for creating shared memory segments.
 * Use Chromium-supplied functions for both of these.

BUG=http://code.google.com/p/chromium/issues/detail?id=36676
TEST=nacl_ui_tests with sandbox enabled

Committed: http://code.google.com/p/nativeclient/source/detail?r=1643

[Mark Seaborn, 2010-03-04 10:56:30]

The corresponding Chromium change (which this depends on) is
http://codereview.chromium.org/669055

[Mark Schneckloth, 2010-03-04 17:31:56]

LGTM

[gregoryd, 2010-03-04 17:37:45]

http://codereview.chromium.org/669056/diff/1/2
File src/shared/imc/nacl_imc_unistd.cc (right):

http://codereview.chromium.org/669056/diff/1/2#newcode94
src/shared/imc/nacl_imc_unistd.cc:94: return
MakeSharedMemorySegmentViaIPC(length);
Do we know that shm_open will fail in the sandbox? If so, why do we try and not
call MakeSharedMemorySegmentViaIPC?

[Mark Seaborn, 2010-03-04 21:25:25]

On 2010/03/04 17:37:45, gregoryd wrote:
> http://codereview.chromium.org/669056/diff/1/2
> File src/shared/imc/nacl_imc_unistd.cc (right):
> 
> http://codereview.chromium.org/669056/diff/1/2#newcode94
> src/shared/imc/nacl_imc_unistd.cc:94: return
> MakeSharedMemorySegmentViaIPC(length);
> Do we know that shm_open will fail in the sandbox? If so, why do we try and
not
> call MakeSharedMemorySegmentViaIPC?

I should add a comment to clarify this... Trying both is a temporary measure. 
This code will run in the context of both the renderer and (Chromium's
compiled-in) sel_ldr.  Initially, sel_ldr won't be sandboxed (until I submit the
change that sandboxes it) and won't have the appropriate socket FD to the
browser process set up, so we need to try both means.

Mark