Linux Sandbox: make renderers dumpable

Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859
Committed: https://crrev.com/b754672cde7798e21b3d5e5838bb7308bf12e594
Cr-Commit-Position: refs/heads/master@{#364734}

[jln (very slow on Chromium), 2015-12-11 02:01:16]

Description was changed from

==========
Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859
==========

to

==========
Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859
==========

[jln (very slow on Chromium), 2015-12-11 02:01:16]

jln@chromium.org changed reviewers:
+ rickyz@chromium.org

[jln (very slow on Chromium), 2015-12-11 02:01:30]

Ricky: PTAL!

[rickyz (no longer on Chrome), 2015-12-11 02:04:44]

lgtm assuming you're OK with getting rid of the crash test handler, thanks!

https://chromiumcodereview.appspot.com/1519753002/diff/1/content/common/sandb...
File content/common/sandbox_linux/sandbox_linux.cc (left):

https://chromiumcodereview.appspot.com/1519753002/diff/1/content/common/sandb...
content/common/sandbox_linux/sandbox_linux.cc:191:
CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers());
Do we care about the crash test handler that installs a signal handler that
calls chroot?

[rickyz (no longer on Chrome), 2015-12-11 02:04:44]

lgtm assuming you're OK with getting rid of the crash test handler, thanks!

https://chromiumcodereview.appspot.com/1519753002/diff/1/content/common/sandb...
File content/common/sandbox_linux/sandbox_linux.cc (left):

https://chromiumcodereview.appspot.com/1519753002/diff/1/content/common/sandb...
content/common/sandbox_linux/sandbox_linux.cc:191:
CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers());
Do we care about the crash test handler that installs a signal handler that
calls chroot?

[jln (very slow on Chromium), 2015-12-11 17:53:44]

Thanks!

https://chromiumcodereview.appspot.com/1519753002/diff/1/content/common/sandb...
File content/common/sandbox_linux/sandbox_linux.cc (left):

https://chromiumcodereview.appspot.com/1519753002/diff/1/content/common/sandb...
content/common/sandbox_linux/sandbox_linux.cc:191:
CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers());
On 2015/12/11 02:04:44, rickyz wrote:
> Do we care about the crash test handler that installs a signal handler that
> calls chroot?

Yeah, it's kind of ugly, but one can always pass --disable-namespace-sandbox to
use it. This was introduced because we had to debug official release builds as
shipped to the users at some point.

[jln (very slow on Chromium), 2015-12-11 17:53:49]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2015-12-11 17:54:59]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1519753002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1519753002/1

[commit-bot: I haz the power, 2015-12-11 18:08:03]

Description was changed from

==========
Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859
==========

to

==========
Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859
==========

[commit-bot: I haz the power, 2015-12-11 18:08:04]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-12-11 18:09:56]

Description was changed from

==========
Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859
==========

to

==========
Linux Sandbox: make renderers dumpable

Make renderers dumpable if one PID namespace per renderer is used.
This will allow the browser to look at renderers via /proc/ and also
allow developpers to send SEGV signals to renderers that won't be ignored.

BUG=568859

Committed: https://crrev.com/b754672cde7798e21b3d5e5838bb7308bf12e594
Cr-Commit-Position: refs/heads/master@{#364734}
==========

[commit-bot: I haz the power, 2015-12-11 18:09:56]

Patchset 1 (id:??) landed as
https://crrev.com/b754672cde7798e21b3d5e5838bb7308bf12e594
Cr-Commit-Position: refs/heads/master@{#364734}