Linux sandbox: Tighten up the NaCl sandbox policy.

chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc

Index: chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc
diff --git a/chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc b/chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc
index fc1c80e869b591e77d3f846141a6bba693278b53..a5db4679e8a7ba6cbcfd52c86b1a1f594f4789f1 100644
--- a/chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc
+++ b/chrome/browser/nacl_host/test/gdb_debug_stub_browsertest.cc
@@ -12,6 +12,7 @@
 #include "chrome/test/ppapi/ppapi_test.h"
 #include "components/nacl/browser/nacl_browser.h"
 #include "components/nacl/common/nacl_switches.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/test/test_utils.h"
 
 class NaClGdbDebugStubTest : public PPAPINaClNewlibTest {
@@ -30,6 +31,8 @@ class NaClGdbDebugStubTest : public PPAPINaClNewlibTest {
 void NaClGdbDebugStubTest::SetUpCommandLine(CommandLine* command_line) {
   PPAPINaClNewlibTest::SetUpCommandLine(command_line);
   command_line->AppendSwitch(switches::kEnableNaClDebug);
+  // The debug stub requires --no-sandbox.

[Mark Seaborn, 2014/10/21 22:08:40]

Well, we don't *want* using the debug stub to require --no-sandbox.  That makes
it less secure, and more awkward to use, and it would require documenting.

[rickyz (no longer on Chrome), 2014/10/22 03:25:05]

Ah, upon further inspection, it looks like the recommendation at
http://www.chromium.org/nativeclient/how-tos/debugging-documentation/debuggin...
applies to windows only. Agreed that allowing those syscalls if
--enable-nacl-debug is enabled is better - I switched to doing that instead.

+  command_line->AppendSwitch(switches::kNoSandbox);
 }
 
 void NaClGdbDebugStubTest::StartTestScript(base::ProcessHandle* test_process,