Default to enabling the namespace sandbox when possible.

Default to enabling the namespace sandbox when possible.

This can be disabled using the --disable-namespace-sandbox flag.

BUG=312380
Committed: https://crrev.com/21750b1dac21f0d534f218c28fca8d588885f90a
Cr-Commit-Position: refs/heads/master@{#316193}

[rickyz (no longer on Chrome), 2015-02-09 22:48:47]

rickyz@chromium.org changed reviewers:
+ jln@chromium.org

[jln (very slow on Chromium), 2015-02-09 23:10:43]

This looks good, but if you run the try bots, a couple of tests should start
failing. Most notably, have a look at
chrome/test/data/webui/sandboxstatus_browsertest.js

Outside of that, I apologize in advance, but there are almost certainly security
tests downstream in Chrome OS land that will start failing. I'll locate that for
you.

[rickyz (no longer on Chrome), 2015-02-09 23:19:26]

On 2015/02/09 23:10:43, jln wrote:
> This looks good, but if you run the try bots, a couple of tests should start
> failing. Most notably, have a look at
> chrome/test/data/webui/sandboxstatus_browsertest.js
> 
> Outside of that, I apologize in advance, but there are almost certainly
security
> tests downstream in Chrome OS land that will start failing. I'll locate that
for
> you.

Ah, I had actually specifically tested with the flag check disabled on the
previous CL, but perhaps the bots which ran this test must not have supported
user namespaces. Thanks for the pointers.

[jln (very slow on Chromium), 2015-02-09 23:56:15]

On 2015/02/09 23:19:26, rickyz wrote:

> Ah, I had actually specifically tested with the flag check disabled on the
> previous CL, but perhaps the bots which ran this test must not have supported
> user namespaces. Thanks for the pointers.

Hmm that's a bad sign then. I hope these tests are still running somewhere..

[jln (very slow on Chromium), 2015-02-10 01:45:18]

lgtm, but I'm concerned that these tests are not running. Maybe they're still
running on the WF, but not on try bots?

I would also highly recommend to split fixing the tests to another CL to keep
this one trivial. Merging/reverting on branches 3 months later is such as pain
that I think it's worth the cost. Up to you though!

[rickyz (no longer on Chrome), 2015-02-10 01:48:41]

Patchset #2 (id:20001) has been deleted

[jln (very slow on Chromium), 2015-02-11 03:07:14]

not lgtm here to safeguard against miss-clicks on the checkbox until we land a
few pending CLs.

[jln (very slow on Chromium), 2015-02-12 17:42:47]

lgtm

[rickyz (no longer on Chrome), 2015-02-12 20:00:47]

New patchsets have been uploaded after l-g-t-m from jln@chromium.org

[rickyz (no longer on Chrome), 2015-02-12 20:02:15]

rickyz@chromium.org changed reviewers:
+ nasko@chromium.org

[rickyz (no longer on Chrome), 2015-02-12 20:02:16]

Adding nasko@ for content/public/common

[nasko, 2015-02-12 23:04:37]

LGTM with a nit.

https://codereview.chromium.org/915433002/diff/40001/content/public/common/co...
File content/public/common/content_switches.cc (right):

https://codereview.chromium.org/915433002/diff/40001/content/public/common/co...
content/public/common/content_switches.cc:194: // Disables using the namespace
sandbox.
nit: s/using/usage/

[rickyz (no longer on Chrome), 2015-02-12 23:29:47]

New patchsets have been uploaded after l-g-t-m from nasko@chromium.org

[rickyz (no longer on Chrome), 2015-02-13 08:45:17]

Woo, chromeos trybot succeeded, so checking CQ.

https://codereview.chromium.org/915433002/diff/40001/content/public/common/co...
File content/public/common/content_switches.cc (right):

https://codereview.chromium.org/915433002/diff/40001/content/public/common/co...
content/public/common/content_switches.cc:194: // Disables using the namespace
sandbox.
On 2015/02/12 23:04:36, nasko wrote:
> nit: s/using/usage/

Done.

[rickyz (no longer on Chrome), 2015-02-13 08:45:22]

The CQ bit was checked by rickyz@chromium.org

[commit-bot: I haz the power, 2015-02-13 08:46:34]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/915433002/60001

[commit-bot: I haz the power, 2015-02-13 08:49:28]

Committed patchset #3 (id:60001)

[commit-bot: I haz the power, 2015-02-13 08:49:58]

Patchset 3 (id:??) landed as
https://crrev.com/21750b1dac21f0d534f218c28fca8d588885f90a
Cr-Commit-Position: refs/heads/master@{#316193}