Add a whitelist check for nacl-nonsfi mode

components/nacl/renderer/ppb_nacl_private_impl.cc

Index: components/nacl/renderer/ppb_nacl_private_impl.cc
diff --git a/components/nacl/renderer/ppb_nacl_private_impl.cc b/components/nacl/renderer/ppb_nacl_private_impl.cc
index a4020d98a2107166603d2ff9f0f9e684db40a14e..dc2ccf69a1b17cd05cc714f754b50a29c8965159 100644
--- a/components/nacl/renderer/ppb_nacl_private_impl.cc
+++ b/components/nacl/renderer/ppb_nacl_private_impl.cc
@@ -501,7 +501,13 @@ int32_t GetNumberOfProcessors() {
 }
 
 PP_Bool IsNonSFIModeEnabled() {
-#if defined(OS_LINUX)
+  // Note that this only indicates whether non-sfi mode *can* run for a given
+  // platform and if nonsfi manifest entries are preferred.  There can be other
+  // restrictions which prevent a particular module from launching.  See
+  // NaClProcessHost::Launch which makes the final determination.
+#if defined(OS_CHROMEOS)
+  return PP_TRUE;

[Mark Seaborn, 2014/05/03 01:37:59]

Hmm, really the browser should tell the renderer whether a given app is allowed
to run under Non-SFI mode.  (Or is that difficult to plumb through?)

Otherwise, if a non-whitelisted app contains SFI and Non-SFI entries in its NMF,
it would break on Chrome OS.  The renderer would request a Non-SFI process
launch, only to have it rejected by the browser.

Or would you say that it's OK for this to break, because non-whitelisted apps
shouldn't list Non-SFI nexes in their NMFs?  (That might be OK, unless the
whitelisting status of an app changes.)

[elijahtaylor1, 2014/05/06 05:56:15]

It's not incredibly difficult to plumb this IPC, but it does require changing
the NaCl Private interface (to add an instance parameter so we can look up the
manifest location), and I'm not sure it's worth it.  I would argue what you
wrote last, that non-whitelisted apps shouldn't have nonsfi entries.

Let me know what you think, I could be convinced either way.

[Mark Seaborn, 2014/05/08 01:06:02]

OK.  Can you comment this limitation somewhere appropriate in the code, please?

+#elif defined(OS_LINUX)
   return PP_FromBool(CommandLine::ForCurrentProcess()->HasSwitch(
                          switches::kEnableNaClNonSfiMode));
 #else