Linux sandbox: report TSYNC status in chrome://sandbox

Linux sandbox: report TSYNC status in chrome://sandbox

TSYNC is a new sandboxing flag for seccomp that was recently added to
the Linux kernel.

If TSYNC is supported by the kernel, it is automatically used when enabling
seccomp-bpf).

When seccomp-bpf is enabled, we now report if TSYNC is supported by the kernel
in chrome://sandbox.

This allows users and developers to check their level of sandboxing and to
know how the sandbox has been enabled on their running instance of Chrome.

TBR=nasko

Committed: https://crrev.com/615a8e4ee208162fa28c68354f0db604cd9b4359
Cr-Commit-Position: refs/heads/master@{#305885}

[jln (very slow on Chromium), 2014-11-25 23:55:26]

jln@chromium.org changed reviewers:
+ jorgelo@chromium.org, keescook@google.com

[jln (very slow on Chromium), 2014-11-25 23:55:35]

jln@chromium.org changed reviewers:
+ keescook@chromium.org
- keescook@google.com

[jln (very slow on Chromium), 2014-11-25 23:56:20]

Jorge: PTAL!

keescook: mostly FYI

[Jorge Lucangeli Obes, 2014-11-26 00:01:23]

lgtm

[Kees Cook, 2014-11-26 00:06:14]

lgtm

[jln (very slow on Chromium), 2014-11-26 00:09:16]

jln@chromium.org changed reviewers:
+ jhawkins@chromium.org

[jln (very slow on Chromium), 2014-11-26 00:09:39]

James: could you please approve the small change in
chrome/browser/ui/webui/about_ui.cc ?

[James Hawkins, 2014-11-26 00:11:30]

What is this for?

[jln (very slow on Chromium), 2014-11-26 01:04:52]

On 2014/11/26 00:11:30, James Hawkins wrote:
> What is this for?

We added a new kernel feature for sandboxing, and we want to report when it's
enabled / in used (which is that chrome://sandbox is for). It's generally, at
most, power-user facing, not end-user facing.

It's quite important to expose this though, especially on Linux because we often
have no idea what configuration our users are in (and we want them to be able to
check that sandboxing is properly enabled).

[James Hawkins, 2014-11-26 17:09:59]

On 2014/11/26 01:04:52, jln wrote:
> On 2014/11/26 00:11:30, James Hawkins wrote:
> > What is this for?
> 
> We added a new kernel feature for sandboxing, and we want to report when it's
> enabled / in used (which is that chrome://sandbox is for). It's generally, at
> most, power-user facing, not end-user facing.
> 
> It's quite important to expose this though, especially on Linux because we
often
> have no idea what configuration our users are in (and we want them to be able
to
> check that sandboxing is properly enabled).

Most of the information should probably go into the change description.

LGTM

[jln (very slow on Chromium), 2014-11-26 19:54:43]

On 2014/11/26 17:09:59, James Hawkins wrote:
> Most of the information should probably go into the change description.

Done, thanks!

[jln (very slow on Chromium), 2014-11-26 19:55:08]

jln@chromium.org changed reviewers:
+ nasko@chromium.org

[jln (very slow on Chromium), 2014-11-26 19:55:34]

Nasko: TBR for tiny mechanical change in content/public/common/sandbox_linux.h

[jln (very slow on Chromium), 2014-11-26 19:55:39]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2014-11-26 19:56:27]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/758063005/1

[commit-bot: I haz the power, 2014-11-26 21:08:31]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2014-11-26 21:09:08]

Patchset 1 (id:??) landed as
https://crrev.com/615a8e4ee208162fa28c68354f0db604cd9b4359
Cr-Commit-Position: refs/heads/master@{#305885}

[nasko, 2014-12-08 18:07:23]

lgtm