Clear environment variables for nacl_helper

base/process/launch_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/process/launch.h"
 
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
@@ skipping 274 matching lines @@
     fd_shuffle_size = options.fds_to_remap->size();
   }
 
   InjectiveMultimap fd_shuffle1;
   InjectiveMultimap fd_shuffle2;
   fd_shuffle1.reserve(fd_shuffle_size);
   fd_shuffle2.reserve(fd_shuffle_size);
 
   scoped_ptr<char*[]> argv_cstr(new char*[argv.size() + 1]);
   scoped_ptr<char*[]> new_environ;
+  char* const empty_environ = NULL;
+  char* const* old_environ = GetEnvironment();
+  if (options.clear_environ)
+    old_environ = &empty_environ;
   if (!options.environ.empty())
-    new_environ = AlterEnvironment(GetEnvironment(), options.environ);
+    new_environ = AlterEnvironment(old_environ, options.environ);
 
   sigset_t full_sigset;
   sigfillset(&full_sigset);
   const sigset_t orig_sigmask = SetSignalMask(full_sigset);
 
   pid_t pid;
 #if defined(OS_LINUX)
   if (options.clone_flags) {
     // Signal handling in this function assumes the creation of a new
     // process, so we check that a thread is not being created by mistake
@@ skipping 105 matching lines @@
     if (options.fds_to_remap) {
       // Cannot use STL iterators here, since debug iterators use locks.
       for (size_t i = 0; i < options.fds_to_remap->size(); ++i) {
         const FileHandleMappingVector::value_type& value =
             (*options.fds_to_remap)[i];
         fd_shuffle1.push_back(InjectionArc(value.first, value.second, false));
         fd_shuffle2.push_back(InjectionArc(value.first, value.second, false));
       }
     }
 
-    if (!options.environ.empty())
+    if (!options.environ.empty() || options.clear_environ)
       SetEnvironment(new_environ.get());
 
     // fd_shuffle1 is mutated by this call because it cannot malloc.
     if (!ShuffleFileDescriptors(&fd_shuffle1))
       _exit(127);
 
     CloseSuperfluousFds(fd_shuffle2);
 
     // Set NO_NEW_PRIVS by default. Since NO_NEW_PRIVS only exists in kernel
     // 3.5+, do not check the return value of prctl here.
@@ skipping 216 matching lines @@
                               std::string* output,
                               int* exit_code) {
   // Run |execve()| with the current environment and store "unlimited" data.
   GetAppOutputInternalResult result = GetAppOutputInternal(
       cl.argv(), NULL, output, std::numeric_limits<std::size_t>::max(), true,
       exit_code);
   return result == EXECUTE_SUCCESS;
 }
 
 }  // namespace base