New NaCl zygote implementation 2

base/process_util.h

Index: base/process_util.h
diff --git a/base/process_util.h b/base/process_util.h
index 3e758d4defdd3ad4707f2532b5258b83e12875a6..9f66669eac73334cb7f11ca1ae167b5e2051b866 100644
--- a/base/process_util.h
+++ b/base/process_util.h
@@ -286,6 +286,15 @@ BASE_API bool LaunchAppInNewProcessGroup(
     bool wait,
     ProcessHandle* process_handle);
 
+#if defined(OS_LINUX)
+// Similar to LaunchApp variants above except uses clone(.. clone_flags ..)
+// rather than fork(). This is useful for work inside the setuid sandbox.
+BASE_API bool LaunchAppWithClone(const std::vector<std::string>& argv,

[Mark Seaborn, 2011/06/15 16:09:04]

Please bear in mind Brett Wilson's post from January on chromium-dev: 'Base is
"done"';
http://groups.google.com/a/chromium.org/group/chromium-dev/browse_thread/thre....

Calling clone()+execve() is simple enough that you probably don't need to add a
new function to 'base' for it.

[Brad Chen, 2011/06/15 18:47:47]

Hmm... I'd have to mimic/copy ~100 lines of code from LaunchAppImpl() if I
didn't create this new variant. That seems much worse than this change.

On 2011/06/15 16:09:04, Mark Seaborn wrote:

[Brad Chen, 2011/06/20 22:09:47]

Today I spent some time trying to use clone/execvp directly. I am getting
mysterious failures in another thread, process_ not defined. After copying a
bunch of code from LaunchAppImpl() it appears to me it is not a simple matter of
clone+execvp, and it would be better to add LaunchAppWithClone() rather than
complicated/duplicate launching functionality in the caller. Of course I will
clear this with an OWNER on base before committing. 

On 2011/06/15 18:47:47, Brad Chen wrote:

+                                 const file_handle_mapping_vector& fds_to_remap,
+                                 bool wait, ProcessHandle* process_handle,
+                                 int clone_flags);
+#endif
+
 // AlterEnvironment returns a modified environment vector, constructed from the
 // given environment and the list of changes given in |changes|. Each key in
 // the environment is matched against the first element of the pairs. In the