Add seccomp sandbox for non-SFI NaCl

components/nacl/zygote/nacl_fork_delegate_linux.cc

Index: components/nacl/zygote/nacl_fork_delegate_linux.cc
diff --git a/components/nacl/zygote/nacl_fork_delegate_linux.cc b/components/nacl/zygote/nacl_fork_delegate_linux.cc
index 1b9c7af7765f0a855966baba96b32765784c6f3f..c4f78143094e991183eccdd42faf717f4b9566e1 100644
--- a/components/nacl/zygote/nacl_fork_delegate_linux.cc
+++ b/components/nacl/zygote/nacl_fork_delegate_linux.cc
@@ -106,7 +106,8 @@ bool SendIPCRequestAndReadReply(int ipc_channel,
 
 NaClForkDelegate::NaClForkDelegate()
     : status_(kNaClHelperUnused),
-      fd_(-1) {}
+      fd_(-1),
+      uses_nonsfi_(false) {}
 
 void NaClForkDelegate::Init(const int sandboxdesc) {
   VLOG(1) << "NaClForkDelegate::Init()";
@@ -252,8 +253,17 @@ bool NaClForkDelegate::CanHelp(const std::string& process_type,
                                std::string* uma_name,
                                int* uma_sample,
                                int* uma_boundary_value) {
-  if (process_type != switches::kNaClLoaderProcess)
+  if (process_type != switches::kNaClLoaderProcess &&
+      process_type != switches::kNaClNonSfiLoaderProcess)
     return false;
+  // We decide whether we will use SFI mode or non-SFI for the next
+  // run based on the process type here.
+  // TODO(hamaji): Have two helpers in content::Zygote and each
+  // NaClForkDelegate should focus on a single mode. This must be done
+  // when we split the helper binary for non-SFI mode from
+  // nacl_helper. Once this has been done, we can remove this check
+  // and uses_nonsfi_ field.
+  uses_nonsfi_ = process_type == switches::kNaClNonSfiLoaderProcess;

[hamaji, 2014/03/14 12:46:23]

This would be probably the most doubtful change in this patch except for seccomp
changes. I think Zygote process sequentially calls Fork after CanHelp so this
should be fine.

Another solution would be add process_type argument to NaClForkDelegate::Fork. I
didn't do this as we will probably add one more NaClForkDelegate instance to
Zygote class and NaClForkDelegate::Fork won't need process_type.

   *uma_name = "NaCl.Client.Helper.StateOnFork";
   *uma_sample = status_;
   *uma_boundary_value = kNaClHelperStatusBoundary;
@@ -273,6 +283,10 @@ pid_t NaClForkDelegate::Fork(const std::vector<int>& fds) {
   // First, send a remote fork request.
   Pickle write_pickle;
   write_pickle.WriteInt(nacl::kNaClForkRequest);
+  // Tell nacl_helper whether it should use SFI mode or non-SFI mode.
+  // TODO(hamaji): Remove this once we have splitted nacl_helper into
+  // two helper binaries. See the comment in CanHelp as well.
+  write_pickle.WriteBool(uses_nonsfi_);
 
   char reply_buf[kNaClMaxIPCMessageLength];
   ssize_t reply_size = 0;