Remove obsolete sandbox disabling logic from testing/test_env.py.

testing/test_env.py

 #!/usr/bin/env python
 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Sets environment variables needed to run a chromium unit test."""
 
 import os
 import stat
 import subprocess
 import sys
 
 # This is hardcoded to be src/ relative to this script.
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
 CHROME_SANDBOX_ENV = 'CHROME_DEVEL_SANDBOX'
 CHROME_SANDBOX_PATH = '/opt/chromium/chrome_sandbox'
 
 
-def should_enable_sandbox(cmd, sandbox_path):
-  """Return a boolean indicating that the current slave is capable of using the
-  sandbox and should enable it.  This should return True iff the slave is a
-  Linux host with the sandbox file present and configured correctly."""
-  if not (sys.platform.startswith('linux') and
-          os.path.exists(sandbox_path)):
-    return False
-
-  # Copy the check in tools/build/scripts/slave/runtest.py.
-  if '--lsan=1' in cmd:
-    return False
-
-  sandbox_stat = os.stat(sandbox_path)
-  if ((sandbox_stat.st_mode & stat.S_ISUID) and
-      (sandbox_stat.st_mode & stat.S_IRUSR) and
-      (sandbox_stat.st_mode & stat.S_IXUSR) and
-      (sandbox_stat.st_uid == 0)):
-    return True
-  return False
-
-
-def get_sandbox_env(cmd, env, verbose=False):
-  """Checks enables the sandbox if it is required, otherwise it disables it.
-  Returns the environment flags to set."""
+def get_sandbox_env(env):
+  """Returns the environment flags needed for the SUID sandbox to work."""
   extra_env = {}
   chrome_sandbox_path = env.get(CHROME_SANDBOX_ENV, CHROME_SANDBOX_PATH)
-
-  if should_enable_sandbox(cmd, chrome_sandbox_path):
-    if verbose:
-      print 'Enabling sandbox. Setting environment variable:'
-      print '  %s="%s"' % (CHROME_SANDBOX_ENV, chrome_sandbox_path)
-    extra_env[CHROME_SANDBOX_ENV] = chrome_sandbox_path
-  else:
-    if verbose:
-      print 'Disabling sandbox.  Setting environment variable:'
-      print '  CHROME_DEVEL_SANDBOX=""'
-    extra_env['CHROME_DEVEL_SANDBOX'] = ''
+  # The above would silently disable the SUID sandbox if the env value were
+  # an empty string. We don't want to allow that. http://crbug.com/245376
+  # TODO(jln): Remove this check once it's no longer possible to disable the
+  # sandbox that way.
+  if not chrome_sandbox_path:
+    chrome_sandbox_path = CHROME_SANDBOX_PATH
+  extra_env[CHROME_SANDBOX_ENV] = chrome_sandbox_path
 
   return extra_env
 
 
 def trim_cmd(cmd):
   """Removes internal flags from cmd since they're just used to communicate from
   the host machine to this script running on the swarm slaves."""
   internal_flags = frozenset(['--asan=0', '--asan=1', '--lsan=0', '--lsan=1'])
   return [i for i in cmd if i not in internal_flags]
 
@@ skipping 61 matching lines @@
     #  directory.
     extra_env['DYLD_LIBRARY_PATH'] = str(isolate_output_dir)
 
   return extra_env
 
 
 def run_executable(cmd, env):
   """Runs an executable with:
     - environment variable CR_SOURCE_ROOT set to the root directory.
     - environment variable LANGUAGE to en_US.UTF-8.
-    - environment variable CHROME_DEVEL_SANDBOX set if need
+    - environment variable CHROME_DEVEL_SANDBOX set
     - Reuses sys.executable automatically.
   """
   extra_env = {}
   # Many tests assume a English interface...
   extra_env['LANG'] = 'en_US.UTF-8'
   # Used by base/base_paths_linux.cc as an override. Just make sure the default
   # logic is used.
   env.pop('CR_SOURCE_ROOT', None)
-  extra_env.update(get_sandbox_env(cmd, env))
+  extra_env.update(get_sandbox_env(env))
 
   # Copy logic from  tools/build/scripts/slave/runtest.py.
   asan = '--asan=1' in cmd
   lsan = '--lsan=1' in cmd
 
   if asan:
     extra_env.update(get_asan_env(cmd, lsan))
   if lsan:
     cmd.append('--no-sandbox')
 
@@ skipping 27 matching lines @@
     print >> sys.stderr, 'Failed to start %s' % cmd
     raise
 
 
 def main():
   return run_executable(sys.argv[1:], os.environ.copy())
 
 
 if __name__ == '__main__':
   sys.exit(main())