Add --enable-seccomp-filter-sandbox to about:flags on Android.

Add --enable-seccomp-filter-sandbox to about:flags on Android.

This also actually defines USE_SECCOMP_BPF in //content/renderer so the
sandbox can be turned on for real.

BUG=166704
R=jln@chromium.org

Committed: https://crrev.com/a30ebba811bf0ec710193473bc9b7b26ce3c09fc
Cr-Commit-Position: refs/heads/master@{#306263}

[jln (very slow on Chromium), 2014-11-26 22:29:55]

lgtm as a temporary thing, but it's unfortunate that we have to fail open on
lack of kernel support. Do you know how hard it would be to have an infobar or
something like that?

Or you could add a chrome://sandbox status on Android, but that will be a little
bit of work (and look very different from the Desktop version which IPC that
info from the Zygote).

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
File content/renderer/renderer_main_platform_delegate_android.cc (right):

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
content/renderer/renderer_main_platform_delegate_android.cc:38: if
(!sandbox::SandboxBPF::SupportsSeccompSandbox(
This is especially problematic since we don't have a chrome://sandbox on
Android.

I imagine you don't want this to be fatal because there wouldn't be an easy way
to revert the flag?

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
content/renderer/renderer_main_platform_delegate_android.cc:40: LOG(WARNING) <<
"Seccomp-BPF sandbox enabled without kernel support. "
LOG(ERROR) at least?

[Robert Sesek, 2014-11-26 22:32:25]

On 2014/11/26 22:29:55, jln wrote:
> lgtm as a temporary thing, but it's unfortunate that we have to fail open on
> lack of kernel support. Do you know how hard it would be to have an infobar or
> something like that?

That's pretty unreasonable right now, given where we have (or rather, don't)
this kernel support.

> Or you could add a chrome://sandbox status on Android, but that will be a
little
> bit of work (and look very different from the Desktop version which IPC that
> info from the Zygote).

Yeah, we have a bug for this (crbug.com/405530)

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
File content/renderer/renderer_main_platform_delegate_android.cc (right):

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
content/renderer/renderer_main_platform_delegate_android.cc:38: if
(!sandbox::SandboxBPF::SupportsSeccompSandbox(
On 2014/11/26 22:29:55, jln wrote:
> This is especially problematic since we don't have a chrome://sandbox on
> Android.
> 
> I imagine you don't want this to be fatal because there wouldn't be an easy
way
> to revert the flag?

Right, if about:flags weren't WebUI I wouldn't have done this.

[Robert Sesek, 2014-11-26 23:21:06]

rsesek@chromium.org changed reviewers:
+ sievers@chromium.org

[Robert Sesek, 2014-11-26 23:21:06]

+sievers for //content OWNERS

[no sievers, 2014-11-26 23:35:11]

lgtm. But how are you going to enable/override this cmdline through the about
flags mechanism based on whether the kernel supports it or not?

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
File content/renderer/renderer_main_platform_delegate_android.cc (right):

https://codereview.chromium.org/759403002/diff/20001/content/renderer/rendere...
content/renderer/renderer_main_platform_delegate_android.cc:38: if
(!sandbox::SandboxBPF::SupportsSeccompSandbox(
On 2014/11/26 22:32:25, Robert Sesek wrote:
> On 2014/11/26 22:29:55, jln wrote:
> > This is especially problematic since we don't have a chrome://sandbox on
> > Android.
> > 
> > I imagine you don't want this to be fatal because there wouldn't be an easy
> way
> > to revert the flag?
> 
> Right, if about:flags weren't WebUI I wouldn't have done this.

Yea you'd have to go to Settings -> Apps and erase the app user data.

[Robert Sesek, 2014-11-27 02:22:49]

On 2014/11/26 23:35:11, sievers wrote:
> lgtm. But how are you going to enable/override this cmdline through the about
> flags mechanism based on whether the kernel supports it or not?

The flag must be turned on _and_ the kernel must support the feature for this to
work. The flag is temporary; once the kernel support rolls out and we have all
the tests passing, the flag will go away. And then the seccomp sandbox will just
get enabled when we detect the kernel support.

[Robert Sesek, 2014-11-27 02:23:05]

The CQ bit was checked by rsesek@chromium.org

[commit-bot: I haz the power, 2014-11-27 02:23:20]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/759403002/20001

[commit-bot: I haz the power, 2014-11-27 02:26:05]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-11-27 02:26:06]

Try jobs failed on following builders:
  mac_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/mac_gpu/builds/87125)
  win_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/win_gpu/builds/91789)
  win8_chromium_rel on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win8_chromium_rel...)
  win_chromium_compile_dbg on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_comp...)
  win_chromium_x64_rel on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[Robert Sesek, 2014-11-27 02:34:57]

The CQ bit was checked by rsesek@chromium.org

[commit-bot: I haz the power, 2014-11-27 02:35:35]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/759403002/40001

[commit-bot: I haz the power, 2014-11-27 03:28:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-11-27 03:28:56]

Try jobs failed on following builders:
  android_clang_dbg_recipe on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_clang_d...)

[Robert Sesek, 2014-12-01 17:12:15]

rsesek@chromium.org changed reviewers:
+ asvitkine@chromium.org

[Robert Sesek, 2014-12-01 17:12:16]

+asvitkine for //tools/metrics OWNERS (about:flags entry)

[Robert Sesek, 2014-12-01 17:24:45]

rsesek@chromium.org changed reviewers:
+ isherman@chromium.org
- asvitkine@chromium.org

[Robert Sesek, 2014-12-01 17:24:46]

+isherman for //tools/metrics OWNERS (about:flags entry)
-asvitkine (OOO)

[Ilya Sherman, 2014-12-01 21:52:03]

histograms.xml lgtm

[Ilya Sherman, 2014-12-01 21:52:07]

The CQ bit was checked by isherman@chromium.org

[commit-bot: I haz the power, 2014-12-01 21:53:08]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/759403002/80001

[commit-bot: I haz the power, 2014-12-01 21:56:10]

Committed patchset #5 (id:80001)

[commit-bot: I haz the power, 2014-12-01 21:56:43]

Patchset 5 (id:??) landed as
https://crrev.com/a30ebba811bf0ec710193473bc9b7b26ce3c09fc
Cr-Commit-Position: refs/heads/master@{#306263}