share all the needed linux code with OpenBSD in chrome and content

content/browser/zygote_main_linux.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/zygote_host_linux.h"
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <sys/socket.h>
@@ skipping 740 matching lines @@
     }
 
     if (reply != kMsgChrootSuccessful) {
       LOG(ERROR) << "Error code reply from chroot helper";
       return false;
     }
 
     SkiaFontConfigSetImplementation(
         new FontConfigIPC(kMagicSandboxIPCDescriptor));
 
+#if defined(OS_LINUX)

[Mark Mentovai, 2011/10/26 23:24:28]

And here.

[Robert Nagy, 2011/10/31 15:38:38]

Done.

     // Previously, we required that the binary be non-readable. This causes the
     // kernel to mark the process as non-dumpable at startup. The thinking was
     // that, although we were putting the renderers into a PID namespace (with
     // the SUID sandbox), they would nonetheless be in the /same/ PID
     // namespace. So they could ptrace each other unless they were non-dumpable.
     //
     // If the binary was readable, then there would be a window between process
     // startup and the point where we set the non-dumpable flag in which a
     // compromised renderer could ptrace attach.
     //
     // However, now that we have a zygote model, only the (trusted) zygote
     // exists at this point and we can set the non-dumpable flag which is
     // inherited by all our renderer children.
     //
     // Note: a non-dumpable process can't be debugged. To debug sandbox-related
     // issues, one can specify --allow-sandbox-debugging to let the process be
     // dumpable.
     const CommandLine& command_line = *CommandLine::ForCurrentProcess();
     if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) {
       prctl(PR_SET_DUMPABLE, 0, 0, 0, 0);
       if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) {
         LOG(ERROR) << "Failed to set non-dumpable flag";
         return false;
       }
     }
+#endif
 #if defined(SECCOMP_SANDBOX)
   } else if (SeccompSandboxEnabled()) {
     PreSandboxInit();
     SkiaFontConfigSetImplementation(
         new FontConfigIPC(kMagicSandboxIPCDescriptor));
 #endif
   } else {
     SkiaFontConfigUseDirectImplementation();
   }
 
@@ skipping 69 matching lines @@
       VLOG(1) << "Enabling experimental Seccomp sandbox.";
       sandbox_flags |= ZygoteHost::kSandboxSeccomp;
     }
   }
 #endif  // SECCOMP_SANDBOX
 
   Zygote zygote(sandbox_flags, forkdelegate);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }