Apply renderer sandbox to utility processes.

content/utility/utility_main.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/debug/leak_annotations.h"
 #include "base/message_loop/message_loop.h"
 #include "base/threading/platform_thread.h"
 #include "base/timer/hi_res_timer_manager.h"
 #include "content/child/child_process.h"
@@ skipping 12 matching lines @@
 // Mainline routine for running as the utility process.
 int UtilityMain(const MainFunctionParams& parameters) {
   // The main message loop of the utility process.
   base::MessageLoop main_message_loop;
   base::PlatformThread::SetName("CrUtilityMain");
 
 #if defined(OS_LINUX)
   // Initializes the sandbox before any threads are created.
   // TODO(jorgelo): move this after GTK initialization when we enable a strict
   // Seccomp-BPF policy.
-  LinuxSandbox::InitializeSandbox();
+  if (parameters.zygote_child)
+    LinuxSandbox::InitializeSandbox();
 #endif
 
   ChildProcess utility_process;
   utility_process.set_main_thread(new UtilityThreadImpl());
 
   base::HighResolutionTimerManager hi_res_timer_manager;
 
 #if defined(OS_WIN)
   bool no_sandbox = parameters.command_line.HasSwitch(switches::kNoSandbox);
   if (!no_sandbox) {
@@ skipping 10 matching lines @@
 #if defined(LEAK_SANITIZER)
   // Invoke LeakSanitizer before shutting down the utility thread, to avoid
   // reporting shutdown-only leaks.
   __lsan_do_leak_check();
 #endif
 
   return 0;
 }
 
 }  // namespace content