Remove mention of the nacl process in content.

content/common/sandbox_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_policy.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 305 matching lines @@
   sandbox::ResultCode result;
 
   // Add the policy for the client side of a pipe. It is just a file
   // in the \pipe\ namespace. We restrict it to pipes that start with
   // "chrome." so the sandboxed process cannot connect to system services.
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
                            sandbox::TargetPolicy::FILES_ALLOW_ANY,
                            L"\\??\\pipe\\chrome.*");
   if (result != sandbox::SBOX_ALL_OK)
     return false;
-  // Allow the server side of a pipe restricted to the "chrome.nacl."
-  // namespace so that it cannot impersonate other system or other chrome
-  // service pipes.
-  result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
-                           sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
-                           L"\\\\.\\pipe\\chrome.nacl.*");
-  if (result != sandbox::SBOX_ALL_OK)
-    return false;
   // Allow the server side of sync sockets, which are pipes that have
   // the "chrome.sync" namespace and a randomly generated suffix.
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
                            sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
                            L"\\\\.\\pipe\\chrome.sync.*");
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
   // Add the policy for debug message only in debug
 #ifndef NDEBUG
@@ skipping 469 matching lines @@
                              exposed_files.value().c_str());
     if (result != sandbox::SBOX_ALL_OK)
       return 0;
   }
 
   if (!AddGenericPolicy(policy)) {
     NOTREACHED();
     return 0;
   }
 
+#if !defined(NACL_WIN64)
+  GetContentClient()->AddPolicy(cmd_line, policy);

[cpu_(ooo_6.6-7.5), 2013/03/15 17:58:53]

how about not having this #if here and have it in the other side of the call?

[jam, 2013/03/15 18:06:33]

the problem was that the nacl win64 binary doesn't link with ContentClient.

btw i'm still trying to find a clean way of doing this :) (that's why I didn't
send it out for review yet)

+#endif
+
   if (browser_command_line.HasSwitch(switches::kEnableLogging)) {
     // If stdout/stderr point to a Windows console, these calls will
     // have no effect.
     policy->SetStdoutHandle(GetStdHandle(STD_OUTPUT_HANDLE));
     policy->SetStderrHandle(GetStdHandle(STD_ERROR_HANDLE));
   }
 
   TRACE_EVENT_BEGIN_ETW("StartProcessWithAccess::LAUNCHPROCESS", 0, 0);
 
   result = g_broker_services->SpawnTarget(
@@ skipping 71 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content