Apply renderer sandbox to utility processes.

Apply renderer sandbox to utility processes.

BUG=325893
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=279844

[jln (very slow on Chromium), 2014-06-13 18:52:56]

This makes for a slightly strange interface to start the BPF sandbox.

I think I would rather do this choice in UtilityMain(). |parameters| there,
should know whether or not we should start a sandbox.

Also I'm glad (and not surprised) to see that the renderer policy "just works",
but we should probably still try to come up with a specific policy for a utility
process. I think something similar to the "Baseline" should work, with only a
few API to add (perhaps epoll*), but in the worse case, we could copy the
renderers' policy.

[mdempsky, 2014-06-23 21:56:50]

Updated to decide whether to sandbox in UtilityMain().

[jln (very slow on Chromium), 2014-06-24 01:03:22]

Looks good but let's create a separate policy. Something close to the baseline
should work in practice.

[mdempsky, 2014-06-24 20:03:08]

On 2014/06/24 01:03:22, jln wrote:
> Looks good but let's create a separate policy. Something close to the baseline
> should work in practice.

Done.

[jln (very slow on Chromium), 2014-06-25 00:28:08]

lgtm if the GTK issues are gone.

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/common/sa...
File content/common/sandbox_linux/bpf_utility_policy_linux.cc (right):

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/common/sa...
content/common/sandbox_linux/bpf_utility_policy_linux.cc:28: // TODO(mdempsky):
See if we can limit these further.
Let's mention explicitly that this is a fork of the renderer policy.

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/common/sa...
content/common/sandbox_linux/bpf_utility_policy_linux.cc:34: // clock_getres()
for V8. crbug.com/329053.
FYI: All the exceptions that have been added late with pointers to specific bugs
are almost certainly not needed.

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/utility/u...
File content/utility/utility_main.cc (right):

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/utility/u...
content/utility/utility_main.cc:31: // TODO(jorgelo): move this after GTK
initialization when we enable a strict
Ooch, I had forgotten about this. This could be problematic.

Jorge, do you remember where the GTK initialization was happening? Is it one
that went away with Aura?

[mdempsky, 2014-06-25 00:43:30]

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/common/sa...
File content/common/sandbox_linux/bpf_utility_policy_linux.cc (right):

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/common/sa...
content/common/sandbox_linux/bpf_utility_policy_linux.cc:28: // TODO(mdempsky):
See if we can limit these further.
On 2014/06/25 00:28:08, jln wrote:
> Let's mention explicitly that this is a fork of the renderer policy.

Done.

https://chromiumcodereview.appspot.com/333823002/diff/60001/content/common/sa...
content/common/sandbox_linux/bpf_utility_policy_linux.cc:34: // clock_getres()
for V8. crbug.com/329053.
On 2014/06/25 00:28:08, jln wrote:
> FYI: All the exceptions that have been added late with pointers to specific
bugs
> are almost certainly not needed.

Yep, was planning on tackling that in a followup.  I've explicitly mentioned
that in the above comment to make sure I don't forget though. :)

[Jorge Lucangeli Obes, 2014-06-25 00:49:52]

There shouldn't be any issues with GTK since the Aura switch.

https://chromiumcodereview.appspot.com/333823002/diff/80001/content/common/sa...
File content/common/sandbox_linux/bpf_utility_policy_linux.h (right):

https://chromiumcodereview.appspot.com/333823002/diff/80001/content/common/sa...
content/common/sandbox_linux/bpf_utility_policy_linux.h:12: // This policy can
be used by both utility processes.
What does "both utility processes" mean here?

[mdempsky, 2014-06-25 00:52:59]

https://chromiumcodereview.appspot.com/333823002/diff/80001/content/common/sa...
File content/common/sandbox_linux/bpf_utility_policy_linux.h (right):

https://chromiumcodereview.appspot.com/333823002/diff/80001/content/common/sa...
content/common/sandbox_linux/bpf_utility_policy_linux.h:12: // This policy can
be used by both utility processes.
On 2014/06/25 00:49:52, Jorge Lucangeli Obes wrote:
> What does "both utility processes" mean here?

Whoops, fixed.  Originally it was "both renderers and worker processes", and I
only half fixed it.

[jln (very slow on Chromium), 2014-06-25 00:53:02]

On 2014/06/25 00:49:52, Jorge Lucangeli Obes wrote:
> There shouldn't be any issues with GTK since the Aura switch.

Do you remember exactly what was triggering the initialization? Aura is still
internally using GTK for a few things of course, but I don't think that any
Zygote processes can / does use it directly since the switch though.

[Jorge Lucangeli Obes, 2014-06-25 01:21:30]

On 2014/06/25 00:53:02, jln wrote:
> On 2014/06/25 00:49:52, Jorge Lucangeli Obes wrote:
> > There shouldn't be any issues with GTK since the Aura switch.
> 
> Do you remember exactly what was triggering the initialization? Aura is still
> internally using GTK for a few things of course, but I don't think that any
> Zygote processes can / does use it directly since the switch though.

We needed to initialize GTK because IIUC the utility process was used to load
some plugins which depended on GTK:
https://code.google.com/p/chromium/codesearch#chromium/src/content/common/uti...

[mdempsky, 2014-06-25 20:25:43]

avi: Please review for content OWNERS approval.

jln and jorgelo have already reviewed the content/common/sandbox_linux changes,
so the only thing you're probably concerned with is the addition of
"zygote_child" to MainFunctionParams.

[Avi (use Gerrit), 2014-06-25 20:27:18]

Yeah, this is cool. LGTM

[mdempsky, 2014-06-25 20:28:44]

The CQ bit was checked by mdempsky@chromium.org

[commit-bot: I haz the power, 2014-06-25 20:33:27]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/mdempsky@chromium.org/333823002/100001

[commit-bot: I haz the power, 2014-06-25 23:04:51]

Change committed as 279844

[gordanac, 2014-06-26 15:25:29]

On 2014/06/25 23:04:51, I haz the power (commit-bot) wrote:
> Change committed as 279844

This change breaks mips build:
http://www.rt-rk.com/mips-buildbot/builders/build_and_test_chromium_with_pnac...

where use_seccomp_bpf=0.

Please exclude:
'common/sandbox_linux/bpf_utility_policy_linux.cc',
'common/sandbox_linux/bpf_utility_policy_linux.h',
if 'use_seccomp_bpf==0'.