Linux: optionally run <argv0>-renderer.

chrome/browser/renderer_host/browser_render_process_host.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Represents the browser side of the browser <--> renderer communication
 // channel. There will be one RenderProcessHost per renderer process.
 
 #include "chrome/browser/renderer_host/browser_render_process_host.h"
 
 #include "build/build_config.h"
 
 #include <algorithm>
 
 #include "base/command_line.h"
+#include "base/file_util.h"
 #include "base/linked_ptr.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/process_util.h"
 #include "base/rand_util.h"
 #include "base/scoped_ptr.h"
 #include "base/shared_memory.h"
 #include "base/singleton.h"
 #include "base/string_util.h"
 #include "base/thread.h"
@@ skipping 84 matching lines @@
   // Deleted in CleanUp() on the renderer thread, so don't use a smart pointer.
   RenderProcess* render_process_;
 };
 
 // Used for a View_ID where the renderer has not been attached yet
 const int32 kInvalidViewID = -1;
 
 // Get the path to the renderer executable, which is the same as the
 // current executable.
 bool GetRendererPath(std::wstring* cmd_line) {
+#if defined(OS_LINUX)
+  // Ubuntu has AppArmor, which triggers based on binary names.  Since we only
+  // want to sandbox the renderers they need to have a different name than the
+  // main Chromium binary (although it can just be a hard link to the same
+  // file). Thus, we probe to see if "<argv0>-renderer" exists. If so, we run
+  // that.
+
+  if (!PathService::Get(base::FILE_EXE, cmd_line))
+    return false;
+  std::wstring alt_path = *cmd_line;
+  alt_path.append(L"-renderer");
+  if (file_util::PathExists(alt_path))
+    *cmd_line = alt_path;
+  return true;
+#else
   return PathService::Get(base::FILE_EXE, cmd_line);
+#endif
 }
 
 BrowserRenderProcessHost::BrowserRenderProcessHost(Profile* profile)
     : RenderProcessHost(profile),
       visible_widgets_(0),
       backgrounded_(true),
       ALLOW_THIS_IN_INITIALIZER_LIST(cached_dibs_cleaner_(
             base::TimeDelta::FromSeconds(5),
             this, &BrowserRenderProcessHost::ClearTransportDIBCache)) {
   widget_helper_ = new RenderWidgetHelper();
@@ skipping 640 matching lines @@
         SendUserScriptsUpdate(shared_memory);
       }
       break;
     }
     default: {
       NOTREACHED();
       break;
     }
   }
 }