Linux sandbox: Tighten up the NaCl sandbox policy.

chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/environment.h"
 #include "base/path_service.h"
 #include "base/process/kill.h"
 #include "base/process/launch.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/test/ppapi/ppapi_test.h"
 #include "components/nacl/browser/nacl_browser.h"
 #include "components/nacl/common/nacl_switches.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/test/test_utils.h"
 
 class NaClGdbDebugStubTest : public PPAPINaClNewlibTest {
  public:
   NaClGdbDebugStubTest() {
   }
 
   virtual void SetUpCommandLine(CommandLine* command_line) override;
 
   void StartTestScript(base::ProcessHandle* test_process,
                        std::string test_name, int debug_stub_port);
   void RunDebugStubTest(const std::string& nacl_module,
                         const std::string& test_name);
 };
 
 void NaClGdbDebugStubTest::SetUpCommandLine(CommandLine* command_line) {
   PPAPINaClNewlibTest::SetUpCommandLine(command_line);
   command_line->AppendSwitch(switches::kEnableNaClDebug);
+  // The debug stub requires --no-sandbox.

[Mark Seaborn, 2014/10/21 22:08:40]

Well, we don't *want* using the debug stub to require --no-sandbox.  That makes
it less secure, and more awkward to use, and it would require documenting.

[rickyz (no longer on Chrome), 2014/10/22 03:25:05]

Ah, upon further inspection, it looks like the recommendation at
http://www.chromium.org/nativeclient/how-tos/debugging-documentation/debuggin...
applies to windows only. Agreed that allowing those syscalls if
--enable-nacl-debug is enabled is better - I switched to doing that instead.

+  command_line->AppendSwitch(switches::kNoSandbox);
 }
 
 void NaClGdbDebugStubTest::StartTestScript(base::ProcessHandle* test_process,
                                            std::string test_name,
                                            int debug_stub_port) {
   // We call python script to reuse GDB RSP protocol implementation.
   CommandLine cmd(base::FilePath(FILE_PATH_LITERAL("python")));
   base::FilePath script;
   PathService::Get(chrome::DIR_TEST_DATA, &script);
   script = script.AppendASCII("nacl/debug_stub_browser_tests.py");
@@ skipping 37 matching lines @@
 #elif defined(OS_LINUX) && !defined(OS_CHROMEOS) && defined(ARCH_CPU_ARM_FAMILY)
 // Timing out on ARM linux: http://crbug.com/238469
 # define MAYBE_Breakpoint DISABLED_Breakpoint
 #else
 # define MAYBE_Breakpoint Breakpoint
 #endif
 
 IN_PROC_BROWSER_TEST_F(NaClGdbDebugStubTest, MAYBE_Breakpoint) {
   RunDebugStubTest("Empty", "breakpoint");
 }