Make NaCl process non-dumpable.

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
index 5c4fa4224f7c2d0efbb4d203911da1286cb40fbb..b949b22bcea84247ac391d91a418a0097c0081b8 100644
--- a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
@@ -6,6 +6,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
@@ -22,6 +23,7 @@
 #include "components/nacl/common/nacl_switches.h"
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
+#include "content/public/common/content_switches.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/services/proc_util.h"
 #include "sandbox/linux/services/thread_helpers.h"
@@ -50,6 +52,21 @@ base::ScopedFD GetProcSelfTask(int proc_fd) {
   return proc_self_task.Pass();
 }
 
+bool MaybeSetProcessNonDumpable() {
+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  if (command_line.HasSwitch(switches::kAllowSandboxDebugging)) {
+    return true;
+  }
+
+  if (prctl(PR_SET_DUMPABLE, 0) != 0) {

[Mark Seaborn, 2015/02/06 21:02:06]

This might not work after https://codereview.chromium.org/888903004/ lands, so
it would be best to check to avoid a collision.

I think it would be necessary to use "prctl(PR_SET_DUMPABLE, 0, 0, 0, 0)",
because native_client/src/public/linux_syscalls/sys/prctl.h declares:

int prctl(int option, uintptr_t arg2, uintptr_t arg3,
          uintptr_t arg4, uintptr_t arg5);

(As does linux_syscall_support.h.  It's a pedantic way to avoid varargs-based
undefined behaviour.)

+    PLOG(ERROR) << "Failed to set non-dumpable flag";
+    return false;
+  }
+
+  return prctl(PR_GET_DUMPABLE) == 0;
+}
+
 }  // namespace
 
 NaClSandbox::NaClSandbox()
@@ -91,6 +108,7 @@ void NaClSandbox::InitializeLayerOneSandbox() {
 
     // Get sandboxed.
     CHECK(setuid_sandbox_client_->ChrootMe());
+    CHECK(MaybeSetProcessNonDumpable());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   }