Ensure seccomp-bpf cannot be silently disabled for non-SFI NaCl

components/nacl/common/nacl_switches.cc

Index: components/nacl/common/nacl_switches.cc
diff --git a/components/nacl/common/nacl_switches.cc b/components/nacl/common/nacl_switches.cc
index 732f0e709fb71c4fb03bd17286fa52e948283887..e0e48e82d68f6f786078b8b9d57c471d0c6f077f 100644
--- a/components/nacl/common/nacl_switches.cc
+++ b/components/nacl/common/nacl_switches.cc
@@ -23,6 +23,11 @@ const char kEnableNaClNonSfiMode[]          = "enable-nacl-nonsfi-mode";
 // (used for launching NaCl loader processes on 64-bit Windows).
 const char kNaClBrokerProcess[]             = "nacl-broker";
 
+// Disable sandbox even for non SFI mode. This is particularly unsafe
+// as non SFI NaCl heavily relies on the seccomp sandbox.
+const char kNaClDangerousNoSandboxNonSfi[]  =
+    "nacl-dangerous-no-sandbox-nonsfi";
+
 // Uses NaCl manifest URL to choose whether NaCl program will be debugged by
 // debug stub.
 // Switch value format: [!]pattern1,pattern2,...,patternN. Each pattern uses
@@ -33,18 +38,18 @@ const char kNaClBrokerProcess[]             = "nacl-broker";
 // if manifest URL does not match any pattern.
 const char kNaClDebugMask[]                 = "nacl-debug-mask";
 
-// Native Client GDB debugger that will be launched automatically when needed.
-const char kNaClGdb[]                       = "nacl-gdb";
-
 // GDB script to pass to the nacl-gdb debugger at startup.
 const char kNaClGdbScript[]                 = "nacl-gdb-script";
 
-// Value for --type that causes the process to run as a NativeClient loader
-// for SFI mode.
-const char kNaClLoaderProcess[]             = "nacl-loader";
+// Native Client GDB debugger that will be launched automatically when needed.
+const char kNaClGdb[]                       = "nacl-gdb";
 
 // Value for --type that causes the process to run as a NativeClient loader
 // for non SFI mode.
 const char kNaClLoaderNonSfiProcess[]       = "nacl-loader-nonsfi";
 
+// Value for --type that causes the process to run as a NativeClient loader
+// for SFI mode.
+const char kNaClLoaderProcess[]             = "nacl-loader";
+
 }  // namespace switches