Move use_suid_sandbox_for_adj_oom_score_ logic to zygote_host_impl_linux.cc.

content/browser/zygote_host/zygote_communication_linux.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/zygote_host/zygote_communication_linux.h"
 
 #include <string.h>
 #include <sys/socket.h>
 
 #include "base/base_switches.h"
+#include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/posix/unix_domain_socket_linux.h"
 #include "content/browser/renderer_host/render_sandbox_host_linux.h"
 #include "content/browser/zygote_host/zygote_host_impl_linux.h"
 #include "content/common/child_process_sandbox_support_impl_linux.h"
 #include "content/common/zygote_commands_linux.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
-#include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_host.h"
 #include "ui/gfx/switches.h"
 
 namespace content {
 
 namespace {
 
 // Receive a fixed message on fd and return the sender's PID.
 // Returns true if the message received matches the expected message.
@@ skipping 18 matching lines @@
 }  // namespace
 
 ZygoteCommunication::ZygoteCommunication()
     : control_fd_(-1),
       control_lock_(),
       pid_(),
       list_of_running_zygote_children_(),
       child_tracking_lock_(),
       sandbox_status_(0),
       have_read_sandbox_status_word_(false),
-      use_suid_sandbox_for_adj_oom_score_(false),
       init_(false) {}
 
 ZygoteCommunication::~ZygoteCommunication() {}
 
 bool ZygoteCommunication::SendMessage(const base::Pickle& data,
                                       const std::vector<int>* fds) {
   DCHECK_NE(-1, control_fd_);
   CHECK(data.size() <= kZygoteMaxMessageLength)
       << "Trying to send too-large message to zygote (sending " << data.size()
       << " bytes, max is " << kZygoteMaxMessageLength << ")";
@@ skipping 213 matching lines @@
       // becomes a renderer process.
       switches::kForceDeviceScaleFactor, switches::kLoggingLevel,
       switches::kNoSandbox, switches::kPpapiInProcess,
       switches::kRegisterPepperPlugins, switches::kV, switches::kVModule,
   };
   cmd_line.CopySwitchesFrom(browser_command_line, kForwardSwitches,
                             arraysize(kForwardSwitches));
 
   GetContentClient()->browser()->AppendExtraCommandLineSwitches(&cmd_line, -1);
 
-  const bool using_namespace_sandbox = ShouldUseNamespaceSandbox();
+  const bool using_namespace_sandbox =
+      ZygoteHostImpl::GetInstance()->ShouldUseNamespaceSandbox();
   // A non empty sandbox_cmd means we want a SUID sandbox.
   const bool using_suid_sandbox =
       !ZygoteHostImpl::GetInstance()->SandboxCommand().empty() &&
       !using_namespace_sandbox;
-  // Use the SUID sandbox for adjusting OOM scores when we are using the setuid
-  // or namespace sandbox. This is needed beacuse the processes are
-  // non-dumpable, so /proc/pid/oom_score_adj can only be written by root.
-  use_suid_sandbox_for_adj_oom_score_ = using_suid_sandbox;
-
-#if defined(OS_CHROMEOS)
-  // Chrome OS has a kernel patch that restricts oom_score_adj. See
-  // crbug.com/576409 for details.
-  if (!ZygoteHostImpl::GetInstance()->SandboxCommand().empty() &&
-      using_namespace_sandbox) {
-    use_suid_sandbox_for_adj_oom_score_ = true;
-  }
-#endif
 
   // Start up the sandbox host process and get the file descriptor for the
   // renderers to talk to it.
   const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket();
   fds_to_map.push_back(std::make_pair(sfd, GetSandboxFD()));
 
   base::ScopedFD dummy_fd;
   if (using_suid_sandbox) {
     scoped_ptr<sandbox::SetuidSandboxHost> sandbox_host(
         sandbox::SetuidSandboxHost::Create());
@@ skipping 101 matching lines @@
       status = tmp_status;
     }
   }
 
   if (status != base::TERMINATION_STATUS_STILL_RUNNING) {
     ZygoteChildDied(handle);
   }
   return static_cast<base::TerminationStatus>(status);
 }
 
-bool ZygoteCommunication::ShouldUseNamespaceSandbox() {
-  const base::CommandLine& command_line =
-      *base::CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kNoSandbox)) {
-    return false;
-  }
-
-  if (command_line.HasSwitch(switches::kDisableNamespaceSandbox)) {
-    return false;
-  }
-
-  if (!sandbox::Credentials::CanCreateProcessInNewUserNS()) {
-    return false;
-  }
-
-  return true;
-}
-
 int ZygoteCommunication::GetSandboxStatus() {
   if (have_read_sandbox_status_word_) {
     return sandbox_status_;
   }
   if (ReadSandboxStatus() == -1) {
     return 0;
   }
   have_read_sandbox_status_word_ = true;
   UMA_HISTOGRAM_SPARSE_SLOWLY("Linux.SandboxStatus", sandbox_status_);
   return sandbox_status_;
 }
 
 }  // namespace content