Zygote most of the uses of the utility process on Linux

Zygote most of the uses of the utility process on Linux

Allow the user of the utility process to specify whether the zygote
should be used on Linux. This allows to sandbox all the uses
of the utility process that don't do FS access, which right now are all
except extension unpacking and NPAPI plugin listing.

This is the first step to get the utility process sandboxed 
on Linux. Since most of the uses of the utility process 
don't do file access, launching all of those from the zygote 
will simplify sandboxing the one that does: extension 
unpacking.

BUG=93109
TEST=Try installing an extension from the web store.


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=113027

[Jorge Lucangeli Obes, 2011-12-01 23:53:19]

I've reworked the utility process Linux sandboxing effort into different CLs, to
accommodate design changes discussed with jln@ (the author of the Linux SUID
sandbox) and various comments.

Since the only problem with sandboxing the utility process on Linux is FS
access, the first step is to get all the non-FS uses of the utility process
zygoted, which solves sandboxing and gives better behaviour regarding updates.

[jam, 2011-12-02 02:30:34]

lgtm

[Aaron Boodman, 2011-12-02 03:10:04]

http://codereview.chromium.org/8770025/diff/1/chrome/browser/extensions/exten...
File chrome/browser/extensions/extension_management_api.cc (right):

http://codereview.chromium.org/8770025/diff/1/chrome/browser/extensions/exten...
chrome/browser/extensions/extension_management_api.cc:216:
utility_host_->set_should_use_zygote(true);
Since most call sites want the zygote enabled, how about defaulting to true.

http://codereview.chromium.org/8770025/diff/1/content/browser/utility_process...
File content/browser/utility_process_host.h (right):

http://codereview.chromium.org/8770025/diff/1/content/browser/utility_process...
content/browser/utility_process_host.h:111: #if defined(OS_LINUX)
It's a shame to require #ifdefs at all the call sites. Can we just have this
compiled in for all platforms and make it a no-op for non-linux?

Also, I think the 'should' is redundant. How about use_zygote_, or
use_linux_zygote_.

[Jorge Lucangeli Obes, 2011-12-02 18:27:16]

http://codereview.chromium.org/8770025/diff/1/chrome/browser/extensions/exten...
File chrome/browser/extensions/extension_management_api.cc (right):

http://codereview.chromium.org/8770025/diff/1/chrome/browser/extensions/exten...
chrome/browser/extensions/extension_management_api.cc:216:
utility_host_->set_should_use_zygote(true);
On 2011/12/02 03:10:04, Aaron Boodman wrote:
> Since most call sites want the zygote enabled, how about defaulting to true.

The good thing about defaulting to false is that we can't accidentally break
users of the utility process that are requiring FS access. I went through my
local checkout carefully and used code search to find all users of
UtilityProcessHost, but I felt it would be safer to keep the default as false.

http://codereview.chromium.org/8770025/diff/1/content/browser/utility_process...
File content/browser/utility_process_host.h (right):

http://codereview.chromium.org/8770025/diff/1/content/browser/utility_process...
content/browser/utility_process_host.h:111: #if defined(OS_LINUX)
On 2011/12/02 03:10:04, Aaron Boodman wrote:
> It's a shame to require #ifdefs at all the call sites. Can we just have this
> compiled in for all platforms and make it a no-op for non-linux?
> 
> Also, I think the 'should' is redundant. How about use_zygote_, or
> use_linux_zygote_.

SGTM, will do.

[Jorge Lucangeli Obes, 2011-12-02 20:43:48]

http://codereview.chromium.org/8770025/diff/1/chrome/browser/extensions/exten...
File chrome/browser/extensions/extension_management_api.cc (right):

http://codereview.chromium.org/8770025/diff/1/chrome/browser/extensions/exten...
chrome/browser/extensions/extension_management_api.cc:216:
utility_host_->set_should_use_zygote(true);
On 2011/12/02 18:27:16, jorgelo wrote:
> On 2011/12/02 03:10:04, Aaron Boodman wrote:
> > Since most call sites want the zygote enabled, how about defaulting to true.
> 
> The good thing about defaulting to false is that we can't accidentally break
> users of the utility process that are requiring FS access. I went through my
> local checkout carefully and used code search to find all users of
> UtilityProcessHost, but I felt it would be safer to keep the default as false.

Actually, scratch that. I'm pretty sure I got all the uses. Let's make the
default true.

[Jorge Lucangeli Obes, 2011-12-02 20:52:31]

Uploaded new version including aa@'s comments.

[Aaron Boodman, 2011-12-03 04:56:21]

LGTM

http://codereview.chromium.org/8770025/diff/4004/content/browser/utility_proc...
File content/browser/utility_process_host.h (right):

http://codereview.chromium.org/8770025/diff/4004/content/browser/utility_proc...
content/browser/utility_process_host.h:112: // Can only be used for tasks that
do not require FS access.
You might want to note that it defaults to true.

[commit-bot: I haz the power, 2011-12-05 18:09:26]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jorgelo@chromium.org/8770025/8001

[commit-bot: I haz the power, 2011-12-05 21:27:01]

Change committed as 113027