mandoline sandbox: prewarm libraries before we raise the sandbox.

mandoline/app/desktop/linux_sandbox.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mandoline/app/desktop/linux_sandbox.h"
 
 #include <fcntl.h>
 #include <sys/syscall.h>
 
 #include "base/bind.h"
@@ skipping 80 matching lines @@
 
 LinuxSandbox::LinuxSandbox(const std::vector<BrokerFilePermission>& permissions)
     : broker_(new sandbox::syscall_broker::BrokerProcess(EPERM, permissions)) {
   broker_->Init(
       base::Bind<bool (*)()>(&sandbox::Credentials::DropAllCapabilities));
   policy_.reset(new SandboxPolicy(broker_.get()));
 }
 
 LinuxSandbox::~LinuxSandbox() {}
 
-// static
-std::vector<BrokerFilePermission> LinuxSandbox::GetPermissions() {
-  std::vector<BrokerFilePermission> permissions;
-  permissions.push_back(BrokerFilePermission::ReadOnly("/dev/urandom"));
-  permissions.push_back(BrokerFilePermission::ReadOnly("/etc/ld.so.cache"));
-  permissions.push_back(BrokerFilePermission::ReadOnlyRecursive("/lib/"));
-  permissions.push_back(BrokerFilePermission::ReadOnlyRecursive("/usr/lib/"));
-  return permissions;
-}
-
 void LinuxSandbox::Warmup() {
   proc_fd_ = sandbox::ProcUtil::OpenProc();
   warmed_up_ = true;
 }
 
 void LinuxSandbox::EngageNamespaceSandbox() {
   CHECK(warmed_up_);
   CHECK_EQ(1, getpid());
   CHECK(sandbox::NamespaceSandbox::InNewPidNamespace());
   CHECK(sandbox::Credentials::MoveToNewUserNS());
@@ skipping 15 matching lines @@
   // The Broker is now bound to this process and should only be destroyed when
   // the process exits or is killed.
   ANNOTATE_LEAKING_OBJECT_PTR(broker_.release());
 }
 
 void LinuxSandbox::Seal() {
   proc_fd_.reset();
 }
 
 }  // namespace mandoline