Move all callers of GetHomeDir() to PathService::Get(base::DIR_HOME).

base/file_util_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/file_util.h"
 
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
@@ skipping 466 matching lines @@
     return true;
   }
 #endif
   return GetTempDir(path);
 }
 #endif  // !defined(OS_MACOSX) && !defined(OS_ANDROID)
 
 #if !defined(OS_MACOSX)  // Mac implementation is in file_util_mac.mm.
 FilePath GetHomeDir() {
 #if defined(OS_CHROMEOS)
-  if (SysInfo::IsRunningOnChromeOS())
-    return FilePath("/home/chronos/user");
+  if (SysInfo::IsRunningOnChromeOS()) {
+    // On Chrome OS chrome::DIR_USER_DATA is overriden with a primary user
+    // homedir once it becomes available.
+    NOTREACHED() << "Called GetHomeDir() without base::DIR_HOME override";
+    return FilePath("/tmp");

[Dmitry Polukhin, 2014/03/17 18:28:30]

I think it is bad idea to use /tmp attacker could control /tmp. I think we
should use some readonly path. For example even root '/' should be better.

[Will Drewry, 2014/04/08 15:55:04]

'/' is definitely a better choice since it isn't writable.  I'm trying to think
if there's a better alternative, but / is certainly good.  If we had "/empty"
that'd be even better, but it doesn't exist :)

+  }
 #endif
 
   const char* home_dir = getenv("HOME");
   if (home_dir && home_dir[0])
     return FilePath(home_dir);
 
 #if defined(OS_ANDROID)
   DLOG(WARNING) << "OS_ANDROID: Home directory lookup not yet implemented.";
 #elif defined(USE_GLIB) && !defined(OS_CHROMEOS)
   // g_get_home_dir calls getpwent, which can fall through to LDAP calls so
@@ skipping 422 matching lines @@
     result = false;
   if (IGNORE_EINTR(close(outfile)) < 0)
     result = false;
 
   return result;
 }
 #endif  // !defined(OS_MACOSX)
 
 }  // namespace internal
 }  // namespace base