Add a whitelist check for nacl-nonsfi mode

components/nacl/renderer/ppb_nacl_private_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/renderer/ppb_nacl_private_impl.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/containers/scoped_ptr_hash_map.h"
@@ skipping 483 matching lines @@
   int32_t num_processors;
   IPC::Sender* sender = content::RenderThread::Get();
   DCHECK(sender);
   if(!sender->Send(new NaClHostMsg_NaClGetNumProcessors(&num_processors))) {
     return 1;
   }
   return num_processors;
 }
 
 PP_Bool IsNonSFIModeEnabled() {
-#if defined(OS_LINUX)
+  // Note that this only indicates whether non-sfi mode *can* run for a given
+  // platform and if nonsfi manifest entries are preferred.  There can be other
+  // restrictions which prevent a particular module from launching.  See
+  // NaClProcessHost::Launch which makes the final determination.
+#if defined(OS_CHROMEOS)
+  return PP_TRUE;

[Mark Seaborn, 2014/05/03 01:37:59]

Hmm, really the browser should tell the renderer whether a given app is allowed
to run under Non-SFI mode.  (Or is that difficult to plumb through?)

Otherwise, if a non-whitelisted app contains SFI and Non-SFI entries in its NMF,
it would break on Chrome OS.  The renderer would request a Non-SFI process
launch, only to have it rejected by the browser.

Or would you say that it's OK for this to break, because non-whitelisted apps
shouldn't list Non-SFI nexes in their NMFs?  (That might be OK, unless the
whitelisting status of an app changes.)

[elijahtaylor1, 2014/05/06 05:56:15]

It's not incredibly difficult to plumb this IPC, but it does require changing
the NaCl Private interface (to add an instance parameter so we can look up the
manifest location), and I'm not sure it's worth it.  I would argue what you
wrote last, that non-whitelisted apps shouldn't have nonsfi entries.

Let me know what you think, I could be convinced either way.

[Mark Seaborn, 2014/05/08 01:06:02]

OK.  Can you comment this limitation somewhere appropriate in the code, please?

+#elif defined(OS_LINUX)
   return PP_FromBool(CommandLine::ForCurrentProcess()->HasSwitch(
                          switches::kEnableNaClNonSfiMode));
 #else
   return PP_FALSE;
 #endif
 }
 
 int32_t GetNexeFd(PP_Instance instance,
                   const char* pexe_url,
                   uint32_t abi_version,
@@ skipping 518 matching lines @@
   &DownloadManifestToBuffer
 };
 
 }  // namespace
 
 const PPB_NaCl_Private* GetNaClPrivateInterface() {
   return &nacl_interface;
 }
 
 }  // namespace nacl