Linux: Add support for chrooted renderers.

http://code.google.com/p/chromium/wiki/LinuxSandboxIPC

Without filesystem access from the renderers, we need another way of
dealing with fontconfig and font loading.

This add support for:
  * An "SBX_D" environment variable in the renderers which is used to
    signal the end of dynamic linking so that the chroot can be
    enforced.
  * A sandbox_host process, running outside the sandbox, to deal with
    fontconfig requests from the renderers. See the wiki page for
    the reasoning behind making it a separate process.
  * A new, custom SkFontHost for Skia. Because this is Chrome
    specific, it will live outside the upstream Skia tree. This
    FontHost can be configured either to drive fontconfig directly
    (for the browser process and for any unsandboxed renderers) or to
    use an IPC system. Since the same SkFontHost has to be linked into
    both the browser and renderer (they are the same binary), this
    switch has to be made at run time.

Sandbox IPC calls are rare (a couple of dozen at page load time) and
add about 50us of overhead for each call.

http://codereview.chromium.org/112074
BUG=8081


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@17575 0039d316-1c4b-4281-b951-d872f2087c98

16 files changed, 1123 insertions, 20 deletions

diff --git a/base/process_util_linux.cc b/base/process_util_linux.cc
index ed8d32d..b68ef02 100644
--- a/base/process_util_linux.cc
+++ b/base/process_util_linux.cc
@@ -60,6 +60,11 @@ bool LaunchApp(const std::vector<std::string>& argv,
 
     CloseSuperfluousFds(fd_shuffle);
 
+    // If we are using the SUID sandbox, it sets a magic environment variable
+    // ("SBX_D"), so we remove that variable from the environment here on the
+    // off chance that it's already set.
+    unsetenv("SBX_D");
+
     scoped_array<char*> argv_cstr(new char*[argv.size() + 1]);
     for (size_t i = 0; i < argv.size(); i++)
       argv_cstr[i] = const_cast<char*>(argv[i].c_str());
diff --git a/chrome/app/chrome_dll_main.cc b/chrome/app/chrome_dll_main.cc
index 006d923..b6c8b51 100644
--- a/chrome/app/chrome_dll_main.cc
+++ b/chrome/app/chrome_dll_main.cc
@@ -399,20 +399,6 @@ int ChromeMain(int argc, const char** argv) {
   InitCrashReporter();
 #endif
 
-#if defined(OS_POSIX)
-  // Bug 11776: we mistakenly created directories world-readable.
-  // Fix old instances of these directories manually.
-  // TODO(evanm): remove this code in a month or two.
-  if (user_data_dir.empty()) {
-    FilePath fix_dir;
-    CHECK(PathService::Get(chrome::DIR_USER_DATA, &fix_dir));
-    struct stat statbuf;
-    CHECK(stat(fix_dir.value().c_str(), &statbuf) == 0);
-    if ((statbuf.st_mode & 0077) != 0)
-      CHECK(chmod(fix_dir.value().c_str(), 0700) == 0);
-  }
-#endif
-
   bool single_process =
 #if defined (GOOGLE_CHROME_BUILD)
     // This is an unsupported and not fully tested mode, so don't enable it for
diff --git a/chrome/browser/browser_main.cc b/chrome/browser/browser_main.cc
index f7145a4..0b4ffc3 100644
--- a/chrome/browser/browser_main.cc
+++ b/chrome/browser/browser_main.cc
@@ -64,6 +64,7 @@
 
 #if defined(OS_LINUX)
 #include "chrome/app/breakpad_linux.h"
+#include "chrome/browser/renderer_host/render_sandbox_host_linux.h"
 #endif
 
 // TODO(port): several win-only methods have been pulled out of this, but
@@ -218,6 +219,8 @@ void AddFirstRunNewTabs(BrowserInit* browser_init,
 
 }  // namespace
 
+extern void SkiaFontConfigUseDirectImplementation();
+
 // Main routine for running as the Browser process.
 int BrowserMain(const MainFunctionParams& parameters) {
   const CommandLine& parsed_command_line = parameters.command_line_;
@@ -246,6 +249,14 @@ int BrowserMain(const MainFunctionParams& parameters) {
   CHECK(sigaction(SIGCHLD, &action, NULL) == 0);
 #endif
 
+#if defined(OS_LINUX)
+  // Construct the sandbox host on the UI thread.
+  Singleton<RenderSandboxHostLinux>::get();
+
+  // Configure Skia in this process to use fontconfig directly.
+  SkiaFontConfigUseDirectImplementation();
+#endif
+
   // Do platform-specific things (such as finishing initializing Cocoa)
   // prior to instantiating the message loop. This could be turned into a
   // broadcast notification.
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index 8cee7ae..7e8d30e 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -36,6 +36,7 @@
 #include "chrome/browser/profile.h"
 #if defined(OS_LINUX)
 #include "chrome/browser/renderer_host/render_crash_handler_host_linux.h"
+#include "chrome/browser/renderer_host/render_sandbox_host_linux.h"
 #endif
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/render_widget_helper.h"
@@ -345,6 +346,10 @@ bool BrowserRenderProcessHost::Init() {
         Singleton<RenderCrashHandlerHostLinux>()->GetDeathSignalSocket();
     if (crash_signal_fd >= 0)
       fds_to_map.push_back(std::make_pair(crash_signal_fd, 4));
+    const int sandbox_ipc_fd =
+        Singleton<RenderSandboxHostLinux>()->GetRendererSocket();
+    if (sandbox_ipc_fd >= 0)
+      fds_to_map.push_back(std::make_pair(sandbox_ipc_fd, 5));
 #endif
     base::LaunchApp(cmd_line.argv(), fds_to_map, false, &process);
 #endif
diff --git a/chrome/browser/renderer_host/render_sandbox_host_linux.cc b/chrome/browser/renderer_host/render_sandbox_host_linux.cc
new file mode 100644
index 0000000..13d96a8
--- /dev/null
+++ b/chrome/browser/renderer_host/render_sandbox_host_linux.cc
@@ -0,0 +1,257 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/renderer_host/render_sandbox_host_linux.h"
+
+#include <stdint.h>
+#include <unistd.h>
+#include <sys/uio.h>
+#include <sys/socket.h>
+#include <sys/epoll.h>
+
+#include "base/eintr_wrapper.h"
+#include "base/process_util.h"
+#include "base/logging.h"
+#include "base/message_loop.h"
+
+#include "SkFontHost_fontconfig_direct.h"
+#include "SkFontHost_fontconfig_ipc.h"
+
+// http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+
+// BEWARE: code in this file run across *processes* (not just threads).
+
+// This code runs in a child process
+class SandboxIPCProcess {
+ public:
+  // lifeline_fd: this is the read end of a pipe which the browser process
+  //   holds the other end of. If the browser process dies, it's descriptors are
+  //   closed and we will noticed an EOF on the pipe. That's our signal to exit.
+  // browser_socket: the 'browser's end of the sandbox IPC socketpair. From the
+  //   point of view of the renderer's, it's talking to the browser but this
+  //   object actually services the requests.
+  SandboxIPCProcess(int lifeline_fd, int browser_socket)
+      : lifeline_fd_(lifeline_fd),
+        browser_socket_(browser_socket),
+        font_config_(new FontConfigDirect()) {
+    base::InjectiveMultimap multimap;
+    multimap.push_back(base::InjectionArc(0, lifeline_fd, false));
+    multimap.push_back(base::InjectionArc(0, browser_socket, false));
+
+    base::CloseSuperfluousFds(multimap);
+  }
+
+  void Run() {
+    const int epollfd = epoll_create(2);
+    CHECK(epollfd >= 0);
+    struct epoll_event ev;
+
+    ev.events = EPOLLIN;
+    ev.data.fd = lifeline_fd_;
+    CHECK(0 == epoll_ctl(epollfd, EPOLL_CTL_ADD, lifeline_fd_, &ev));
+
+    ev.events = EPOLLIN;
+    ev.data.fd = browser_socket_;
+    CHECK(0 == epoll_ctl(epollfd, EPOLL_CTL_ADD, browser_socket_, &ev));
+
+    for (;;) {
+      CHECK(1 == HANDLE_EINTR(epoll_wait(epollfd, &ev, 1, -1)));
+      if (ev.data.fd == lifeline_fd_) {
+        // our parent died so we should too.
+        _exit(0);
+      } else {
+        CHECK(ev.data.fd == browser_socket_);
+        HandleRequest(browser_socket_);
+      }
+    }
+  }
+
+  void HandleRequest(int fd) {
+    struct msghdr msg = {0};
+    struct iovec iov;
+    uint8_t buf[1024];
+    uint8_t control_buf[CMSG_SPACE(sizeof(int))];
+    iov.iov_base = buf;
+    iov.iov_len = sizeof(buf);
+    msg.msg_iov = &iov;
+    msg.msg_iovlen = 1;
+    msg.msg_control = control_buf;
+    msg.msg_controllen = sizeof(control_buf);
+
+    const ssize_t n = HANDLE_EINTR(recvmsg(fd, &msg, 0));
+
+    if (n < 1) {
+      LOG(ERROR) << "Error reading from sandbox IPC socket. Sandbox IPC is"
+                 << " disabled."
+                 << " n:" << n
+                 << " errno:" << errno;
+      _exit(1);
+      return;
+    }
+
+    if (msg.msg_controllen != sizeof(control_buf) ||
+        n < static_cast<ssize_t>(sizeof(uint16_t)) ||
+        msg.msg_flags) {
+      LOG(ERROR) << "Sandbox IPC: missing control message or truncated message:"
+                 << " n:" << n
+                 << " msg.msg_controllen:" << msg.msg_controllen
+                 << " msg.msg_flags:" << msg.msg_flags;
+      return;
+    }
+
+    // Get the reply socket from the control message
+    int reply_fd = -1;
+    struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
+    if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
+      // The client cannot send us additional descriptors because the control
+      // message buffer is only sized for a single int.
+      reply_fd = *reinterpret_cast<int*>(CMSG_DATA(cmsg));
+    } else {
+      LOG(ERROR) << "Sandbox IPC: message without reply descriptor:"
+                 << " n:" << n
+                 << " msg.msg_controllen:" << msg.msg_controllen
+                 << " cmsg->cmsg_level:" << cmsg->cmsg_level
+                 << " cmsg->cmsg_type:" << cmsg->cmsg_type;
+      return;
+    }
+
+    const uint16_t request_type = *reinterpret_cast<uint16_t*>(buf);
+    switch (request_type) {
+      case FontConfigIPC::METHOD_MATCH:
+        return FontConfigMatch(reply_fd, buf, n);
+      case FontConfigIPC::METHOD_OPEN:
+        return FontConfigOpen(reply_fd, buf, n);
+      default:
+        LOG(ERROR) << "Sandbox IPC: message with unknown type:"
+                   << " request_type:" << request_type;
+        HANDLE_EINTR(close(reply_fd));
+    }
+  }
+
+  // Send a reply to a client
+  //   reply_fd: the reply channel given to us by the client
+  //   iov, iov_len: the contents of the reply message
+  //   extra_fd: an fd to include in the reply, or -1
+  //
+  // Both reply_fd and extra_fd (if any) are closed.
+  void SendReplyAndClose(int reply_fd, const struct iovec* iov,
+                         unsigned iov_len, int extra_fd) {
+    struct msghdr msg = {0};
+    msg.msg_iov = const_cast<struct iovec*>(iov);
+    msg.msg_iovlen = iov_len;
+
+    uint8_t control_buf[CMSG_SPACE(sizeof(int))];
+
+    if (extra_fd >= 0) {
+      msg.msg_control = control_buf;
+      msg.msg_controllen = sizeof(control_buf);
+
+      struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
+      cmsg->cmsg_level = SOL_SOCKET;
+      cmsg->cmsg_type = SCM_RIGHTS;
+      cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+      *reinterpret_cast<int*>(CMSG_DATA(cmsg)) = extra_fd;
+    }
+
+    HANDLE_EINTR(sendmsg(reply_fd, &msg, MSG_NOSIGNAL | MSG_DONTWAIT));
+    HANDLE_EINTR(close(reply_fd));
+    if (extra_fd >= 0)
+      HANDLE_EINTR(close(extra_fd));
+  }
+
+  void FontConfigMatch(int reply_fd, const uint8_t* request_bytes,
+                       unsigned request_len) {
+    if (request_len < sizeof(FontConfigIPC::MatchRequest))
+      return (void) HANDLE_EINTR(close(reply_fd));
+
+    const FontConfigIPC::MatchRequest* request =
+        reinterpret_cast<const FontConfigIPC::MatchRequest*>(request_bytes);
+
+    if (request_len != sizeof(FontConfigIPC::MatchRequest) + request->family_len)
+      return (void) HANDLE_EINTR(close(reply_fd));
+
+    const std::string family(
+        reinterpret_cast<const char*>(request_bytes + sizeof(*request)),
+        request->family_len);
+    std::string result_family;
+    unsigned result_fileid;
+
+    const bool r = font_config_->Match(
+        &result_family, &result_fileid, request->fileid_valid, request->fileid,
+        family, request->is_bold, request->is_italic);
+
+    struct iovec iov[2];
+    FontConfigIPC::MatchReply reply;
+    memset(&reply, 0, sizeof(reply));
+
+    iov[0].iov_base = &reply;
+    iov[0].iov_len = sizeof(reply);
+
+    if (r) {
+      reply.result = 1;
+      reply.result_fileid = result_fileid;
+      reply.filename_len = result_family.size();
+
+      iov[1].iov_base = const_cast<char*>(result_family.data());
+      iov[1].iov_len = result_family.size();
+    }
+
+    SendReplyAndClose(reply_fd, iov, r ? 2 : 1, -1 /* no fd */);
+  }
+
+  void FontConfigOpen(int reply_fd, const uint8_t* request_bytes,
+                      unsigned request_len) {
+    if (request_len < sizeof(FontConfigIPC::OpenRequest))
+      return (void) HANDLE_EINTR(close(reply_fd));
+
+    const FontConfigIPC::OpenRequest* request =
+        reinterpret_cast<const FontConfigIPC::OpenRequest*>(request_bytes);
+
+    FontConfigDirect* fc = reinterpret_cast<FontConfigDirect*>(font_config_);
+
+    const int result_fd = fc->Open(request->fileid);
+
+    FontConfigIPC::OpenReply reply;
+    reply.result = result_fd >= 0 ? 1 : 0;
+
+    struct iovec iov;
+    iov.iov_base = &reply;
+    iov.iov_len = sizeof(reply);
+
+    SendReplyAndClose(reply_fd, &iov, 1, result_fd);
+  }
+
+ private:
+  const int lifeline_fd_;
+  const int browser_socket_;
+  FontConfigDirect* const font_config_;
+};
+
+// -----------------------------------------------------------------------------
+
+// Runs on the main thread at startup.
+RenderSandboxHostLinux::RenderSandboxHostLinux() {
+  int fds[2];
+  CHECK(socketpair(AF_UNIX, SOCK_DGRAM, 0, fds) == 0);
+
+  renderer_socket_ = fds[0];
+  const int browser_socket = fds[1];
+
+  int pipefds[2];
+  CHECK(0 == pipe(pipefds));
+  const int child_lifeline_fd = pipefds[0];
+  childs_lifeline_fd_ = pipefds[1];
+
+  const pid_t child = fork();
+  if (child == 0) {
+    SandboxIPCProcess handler(child_lifeline_fd, browser_socket);
+    handler.Run();
+    _exit(0);
+  }
+}
+
+RenderSandboxHostLinux::~RenderSandboxHostLinux() {
+  HANDLE_EINTR(close(renderer_socket_));
+  HANDLE_EINTR(close(childs_lifeline_fd_));
+}
diff --git a/chrome/browser/renderer_host/render_sandbox_host_linux.h b/chrome/browser/renderer_host/render_sandbox_host_linux.h
new file mode 100644
index 0000000..43fa447
--- /dev/null
+++ b/chrome/browser/renderer_host/render_sandbox_host_linux.h
@@ -0,0 +1,34 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+
+#ifndef CHROME_BROWSER_RENDERER_HOST_RENDER_SANDBOX_HOST_LINUX_H_
+#define CHROME_BROWSER_RENDERER_HOST_RENDER_SANDBOX_HOST_LINUX_H_
+
+#include "base/singleton.h"
+#include "base/thread.h"
+#include "base/message_loop.h"
+
+// This is a singleton object which handles sandbox requests from the
+// renderers.
+class RenderSandboxHostLinux {
+ public:
+  // Get the file descriptor which renderers should be given in order to signal
+  // crashes to the browser.
+  int GetRendererSocket() const { return renderer_socket_; }
+
+ private:
+  friend struct DefaultSingletonTraits<RenderSandboxHostLinux>;
+  // This object must be constructed on the main thread.
+  RenderSandboxHostLinux();
+  ~RenderSandboxHostLinux();
+
+  int renderer_socket_;
+  int childs_lifeline_fd_;
+
+  DISALLOW_EVIL_CONSTRUCTORS(RenderSandboxHostLinux);
+};
+
+#endif  // CHROME_BROWSER_RENDERER_HOST_RENDER_SANDBOX_HOST_LINUX_H_
diff --git a/chrome/chrome.gyp b/chrome/chrome.gyp
index 0fc4a1d..20518ea 100644
--- a/chrome/chrome.gyp
+++ b/chrome/chrome.gyp
@@ -1183,6 +1183,8 @@
         'browser/renderer_host/download_throttling_resource_handler.h',
         'browser/renderer_host/render_process_host.cc',
         'browser/renderer_host/render_process_host.h',
+        'browser/renderer_host/render_sandbox_host_linux.cc',
+        'browser/renderer_host/render_sandbox_host_linux.h',
         'browser/renderer_host/render_view_host.cc',
         'browser/renderer_host/render_view_host.h',
         'browser/renderer_host/render_view_host_delegate.h',
@@ -1589,6 +1591,7 @@
             # '../build/linux/system.gyp:dbus-glib',
             # '../build/linux/system.gyp:gnome-keyring',
             '../build/linux/system.gyp:gtk',
+            '../skia/skia.gyp:skia',
           ],
           'sources!': [
             'browser/extensions/extension_shelf.cc',
diff --git a/chrome/renderer/renderer_main_platform_delegate_linux.cc b/chrome/renderer/renderer_main_platform_delegate_linux.cc
index 6502129..e997bc9 100644
--- a/chrome/renderer/renderer_main_platform_delegate_linux.cc
+++ b/chrome/renderer/renderer_main_platform_delegate_linux.cc
@@ -4,7 +4,10 @@
 
 #include "chrome/renderer/renderer_main_platform_delegate.h"
 
+#include <stdlib.h>
+
 #include "base/debug_util.h"
+#include "base/eintr_wrapper.h"
 
 // This is a no op class because we do not have a sandbox on linux.
 
@@ -16,6 +19,9 @@ RendererMainPlatformDelegate::RendererMainPlatformDelegate(
 RendererMainPlatformDelegate::~RendererMainPlatformDelegate() {
 }
 
+extern void SkiaFontConfigUseIPCImplementation(int fd);
+extern void SkiaFontConfigUseDirectImplementation();
+
 void RendererMainPlatformDelegate::PlatformInitialize() {
 }
 
@@ -23,18 +29,51 @@ void RendererMainPlatformDelegate::PlatformUninitialize() {
 }
 
 bool RendererMainPlatformDelegate::InitSandboxTests(bool no_sandbox) {
-  // We have no sandbox.
+  // Our sandbox support is in the very early stages
   // http://code.google.com/p/chromium/issues/detail?id=8081
   return true;
 }
 
 bool RendererMainPlatformDelegate::EnableSandbox() {
-  // We have no sandbox.
+  // Our sandbox support is in the very early stages
   // http://code.google.com/p/chromium/issues/detail?id=8081
+
+  const char* const sandbox_fd_string = getenv("SBX_D");
+  if (sandbox_fd_string) {
+    // The SUID sandbox sets this environment variable to a file descriptor
+    // over which we can signal that we have completed our startup and can be
+    // chrooted.
+
+    char* endptr;
+    const long fd_long = strtol(sandbox_fd_string, &endptr, 10);
+    if (!*sandbox_fd_string || *endptr || fd_long < 0 || fd_long > INT_MAX)
+      return false;
+    const int fd = fd_long;
+
+    static const char kChrootMe = 'C';
+    static const char kChrootMeSuccess = 'O';
+
+    if (HANDLE_EINTR(write(fd, &kChrootMe, 1)) != 1)
+      return false;
+
+    char reply;
+    if (HANDLE_EINTR(read(fd, &reply, 1)) != 1)
+      return false;
+    if (reply != kChrootMeSuccess)
+      return false;
+    if (chdir("/") == -1)
+      return false;
+
+    static const int kMagicSandboxIPCDescriptor = 5;
+    SkiaFontConfigUseIPCImplementation(kMagicSandboxIPCDescriptor);
+  } else {
+    SkiaFontConfigUseDirectImplementation();
+  }
+
   return true;
 }
 
 void RendererMainPlatformDelegate::RunSandboxTests() {
-  // We have no sandbox.
+  // Our sandbox support is in the very early stages
   // http://code.google.com/p/chromium/issues/detail?id=8081
 }
diff --git a/skia/ext/SkFontHost_fontconfig.cpp b/skia/ext/SkFontHost_fontconfig.cpp
new file mode 100644
index 0000000..780bc60
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig.cpp
@@ -0,0 +1,236 @@
+/* libs/graphics/ports/SkFontHost_fontconfig.cpp
+**
+** Copyright 2008, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+// -----------------------------------------------------------------------------
+// This file provides implementations of the font resolution members of
+// SkFontHost by using the fontconfig[1] library. Fontconfig is usually found
+// on Linux systems and handles configuration, parsing and caching issues
+// involved with enumerating and matching fonts.
+//
+// [1] http://fontconfig.org
+// -----------------------------------------------------------------------------
+
+#include <map>
+#include <string>
+
+#include <unistd.h>
+#include <sys/stat.h>
+
+#include "SkFontHost.h"
+#include "SkStream.h"
+#include "SkFontHost_fontconfig_impl.h"
+#include "SkFontHost_fontconfig_direct.h"
+#include "SkFontHost_fontconfig_ipc.h"
+
+static FontConfigInterface* global_fc_impl = NULL;
+
+void SkiaFontConfigUseDirectImplementation() {
+    if (global_fc_impl)
+      delete global_fc_impl;
+    global_fc_impl = new FontConfigDirect;
+}
+
+void SkiaFontConfigUseIPCImplementation(int fd) {
+    if (global_fc_impl)
+      delete global_fc_impl;
+    global_fc_impl = new FontConfigIPC(fd);
+}
+
+static void init() __attribute__((constructor));
+static void init() {
+  SkiaFontConfigUseDirectImplementation();
+}
+
+static SkMutex global_fc_map_lock;
+static std::map<uint32_t, SkTypeface *> global_fc_typefaces;
+
+// This is the maximum size of the font cache.
+static const unsigned kFontCacheMemoryBudget = 2 * 1024 * 1024;  // 2MB
+
+// UniqueIds are encoded as (fileid << 8) | style
+
+static unsigned UniqueIdToFileId(unsigned uniqueid)
+{
+    return uniqueid >> 8;
+}
+
+static SkTypeface::Style UniqueIdToStyle(unsigned uniqueid)
+{
+    return static_cast<SkTypeface::Style>(uniqueid & 0xff);
+}
+
+static unsigned FileIdAndStyleToUniqueId(unsigned fileid,
+                                         SkTypeface::Style style)
+{
+    SkASSERT(style & 0xff == style);
+    return (fileid << 8) | static_cast<int>(style);
+}
+
+class FontConfigTypeface : public SkTypeface {
+public:
+    FontConfigTypeface(Style style, uint32_t id)
+        : SkTypeface(style, id)
+    { }
+};
+
+// static
+SkTypeface* SkFontHost::CreateTypeface(const SkTypeface* familyFace,
+                                       const char familyName[],
+                                       SkTypeface::Style style)
+{
+    std::string resolved_family_name;
+
+    if (familyFace) {
+        // Given the fileid we can ask fontconfig for the familyname of the
+        // font.
+        const unsigned fileid = UniqueIdToFileId(familyFace->uniqueID());
+        if (!global_fc_impl->Match(
+          &resolved_family_name, NULL, true /* fileid valid */, fileid, "",
+          -1, -1)) {
+            return NULL;
+        }
+    } else if (familyName) {
+        resolved_family_name = familyName;
+    } else {
+        return NULL;
+    }
+
+    const bool bold = style & SkTypeface::kBold;
+    const bool italic = style & SkTypeface::kItalic;
+    unsigned fileid;
+    if (!global_fc_impl->Match(NULL, &fileid, false, -1, /* no fileid */
+                               resolved_family_name, bold, italic)) {
+        return NULL;
+    }
+
+    const unsigned id = FileIdAndStyleToUniqueId(fileid, style);
+    SkTypeface* typeface = SkNEW_ARGS(FontConfigTypeface, (style, id));
+
+    {
+        SkAutoMutexAcquire ac(global_fc_map_lock);
+        global_fc_typefaces[id] = typeface;
+    }
+
+    return typeface;
+}
+
+// static
+SkTypeface* SkFontHost::CreateTypefaceFromStream(SkStream* stream)
+{
+    SkASSERT(!"SkFontHost::CreateTypefaceFromStream unimplemented");
+    return NULL;
+}
+
+// static
+SkTypeface* SkFontHost::CreateTypefaceFromFile(const char path[])
+{
+    SkASSERT(!"SkFontHost::CreateTypefaceFromFile unimplemented");
+    return NULL;
+}
+
+// static
+bool SkFontHost::ValidFontID(SkFontID uniqueID) {
+    SkAutoMutexAcquire ac(global_fc_map_lock);
+    return global_fc_typefaces.find(uniqueID) != global_fc_typefaces.end();
+}
+
+void SkFontHost::Serialize(const SkTypeface*, SkWStream*) {
+    SkASSERT(!"SkFontHost::Serialize unimplemented");
+}
+
+SkTypeface* SkFontHost::Deserialize(SkStream* stream) {
+    SkASSERT(!"SkFontHost::Deserialize unimplemented");
+    return NULL;
+}
+
+// static
+uint32_t SkFontHost::NextLogicalFont(SkFontID fontID) {
+    // We don't handle font fallback, WebKit does.
+    return 0;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+
+class SkFileDescriptorStream : public SkStream {
+  public:
+    SkFileDescriptorStream(int fd)
+        : fd_(fd) {
+    }
+
+    ~SkFileDescriptorStream() {
+        close(fd_);
+    }
+
+    virtual bool rewind() {
+        if (lseek(fd_, 0, SEEK_SET) == -1)
+            return false;
+        return true;
+    }
+
+    // SkStream implementation.
+    virtual size_t read(void* buffer, size_t size) {
+        if (!buffer && !size) {
+            // This is request for the length of the stream.
+            struct stat st;
+            if (fstat(fd_, &st) == -1)
+                return 0;
+            return st.st_size;
+        }
+
+        if (!buffer) {
+            // This is a request to skip bytes.
+            const off_t current_position = lseek(fd_, 0, SEEK_CUR);
+            if (current_position == -1)
+                return 0;
+            const off_t new_position = lseek(fd_, size, SEEK_CUR);
+            if (new_position == -1)
+                return 0;
+            if (new_position < current_position) {
+                lseek(fd_, current_position, SEEK_SET);
+                return 0;
+            }
+            return new_position;
+        }
+
+        // This is a request to read bytes.
+        return ::read(fd_, buffer, size);
+    }
+
+  private:
+    const int fd_;
+};
+
+///////////////////////////////////////////////////////////////////////////////
+
+// static
+SkStream* SkFontHost::OpenStream(uint32_t id)
+{
+    const unsigned fileid = UniqueIdToFileId(id);
+    const int fd = global_fc_impl->Open(fileid);
+    if (fd < 0)
+        return NULL;
+
+    return SkNEW_ARGS(SkFileDescriptorStream, (fd));
+}
+
+size_t SkFontHost::ShouldPurgeFontCache(size_t sizeAllocatedSoFar)
+{
+    if (sizeAllocatedSoFar > kFontCacheMemoryBudget)
+        return sizeAllocatedSoFar - kFontCacheMemoryBudget;
+    else
+        return 0;   // nothing to do
+}
diff --git a/skia/ext/SkFontHost_fontconfig_direct.cpp b/skia/ext/SkFontHost_fontconfig_direct.cpp
new file mode 100644
index 0000000..001fccd
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_direct.cpp
@@ -0,0 +1,180 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.cpp
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#include "SkFontHost_fontconfig_direct.h"
+
+#include <unistd.h>
+#include <fcntl.h>
+
+#include <fontconfig/fontconfig.h>
+
+FontConfigDirect::FontConfigDirect()
+    : next_file_id_(0) {
+  FcInit();
+}
+
+// -----------------------------------------------------------------------------
+// Normally we only return exactly the font asked for. In last-resort cases,
+// the request is for one of the basic font names "Sans", "Serif" or
+// "Monospace". This function tells you whether a given request is for such a
+// fallback.
+// -----------------------------------------------------------------------------
+static bool IsFallbackFontAllowed(const std::string& family)
+{
+    return family == "Sans" ||
+           family == "Serif" ||
+           family == "Monospace";
+}
+
+bool FontConfigDirect::Match(std::string* result_family,
+                             unsigned* result_fileid,
+                             bool fileid_valid, unsigned fileid,
+                             const std::string& family, int is_bold,
+                             int is_italic) {
+    SkAutoMutexAcquire ac(mutex_);
+    FcPattern* pattern = FcPatternCreate();
+
+    FcValue fcvalue;
+    if (fileid_valid) {
+        const std::map<unsigned, std::string>::const_iterator
+            i = fileid_to_filename_.find(fileid);
+        if (i == fileid_to_filename_.end()) {
+            FcPatternDestroy(pattern);
+            return false;
+        }
+
+        fcvalue.type = FcTypeString;
+        fcvalue.u.s = (FcChar8*) i->second.c_str();
+        FcPatternAdd(pattern, FC_FILE, fcvalue, 0);
+    }
+    if (!family.empty()) {
+        fcvalue.type = FcTypeString;
+        fcvalue.u.s = (FcChar8*) family.c_str();
+        FcPatternAdd(pattern, FC_FAMILY, fcvalue, 0);
+    }
+    if (is_bold > 0) {
+        fcvalue.type = FcTypeInteger;
+        fcvalue.u.i = is_bold ? FC_WEIGHT_BOLD : FC_WEIGHT_NORMAL;
+        FcPatternAdd(pattern, FC_WEIGHT, fcvalue, 0);
+    }
+    if (is_italic > 0) {
+        fcvalue.type = FcTypeInteger;
+        fcvalue.u.i = is_bold ? FC_SLANT_ITALIC : FC_SLANT_ROMAN;
+        FcPatternAdd(pattern, FC_SLANT, fcvalue, 0);
+    }
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    // Font matching:
+    // CSS often specifies a fallback list of families:
+    //    font-family: a, b, c, serif;
+    // However, fontconfig will always do its best to find *a* font when asked
+    // for something so we need a way to tell if the match which it has found is
+    // "good enough" for us. Otherwise, we can return NULL which gets piped up
+    // and lets WebKit know to try the next CSS family name. However, fontconfig
+    // configs allow substitutions (mapping "Arial -> Helvetica" etc) and we
+    // wish to support that.
+    //
+    // Thus, if a specific family is requested we set @family_requested. Then we
+    // record two strings: the family name after config processing and the
+    // family name after resolving. If the two are equal, it's a good match.
+    //
+    // So consider the case where a user has mapped Arial to Helvetica in their
+    // config.
+    //    requested family: "Arial"
+    //    post_config_family: "Helvetica"
+    //    post_match_family: "Helvetica"
+    //      -> good match
+    //
+    // and for a missing font:
+    //    requested family: "Monaco"
+    //    post_config_family: "Monaco"
+    //    post_match_family: "Times New Roman"
+    //      -> BAD match
+    //
+    // However, we special-case fallback fonts; see IsFallbackFontAllowed().
+    FcChar8* post_config_family;
+    FcPatternGetString(pattern, FC_FAMILY, 0, &post_config_family);
+
+    FcResult result;
+    FcPattern* match = FcFontMatch(0, pattern, &result);
+    if (!match) {
+        FcPatternDestroy(pattern);
+        return false;
+    }
+
+    FcChar8* post_match_family;
+    FcPatternGetString(match, FC_FAMILY, 0, &post_match_family);
+    const bool family_names_match =
+        family.empty() ?
+        true :
+        strcasecmp((char *)post_config_family, (char *)post_match_family) == 0;
+
+    FcPatternDestroy(pattern);
+
+    if (!family_names_match && !IsFallbackFontAllowed(family)) {
+        FcPatternDestroy(match);
+        return false;
+    }
+
+    FcChar8* c_filename;
+    if (FcPatternGetString(match, FC_FILE, 0, &c_filename) != FcResultMatch) {
+        FcPatternDestroy(match);
+        return NULL;
+    }
+    const std::string filename((char *) c_filename);
+
+    unsigned out_fileid;
+    if (fileid_valid) {
+        out_fileid = fileid;
+    } else {
+        const std::map<std::string, unsigned>::const_iterator
+            i = filename_to_fileid_.find(filename);
+        if (i == filename_to_fileid_.end()) {
+            out_fileid = next_file_id_++;
+            filename_to_fileid_[filename] = out_fileid;
+            fileid_to_filename_[out_fileid] = filename;
+        } else {
+            out_fileid = i->second;
+        }
+    }
+
+    if (*result_fileid)
+        *result_fileid = out_fileid;
+
+    FcChar8* c_family;
+    if (FcPatternGetString(match, FC_FAMILY, 0, &c_family)) {
+        FcPatternDestroy(match);
+        return NULL;
+    }
+
+    if (result_family)
+        *result_family = (char *) c_family;
+
+    return true;
+}
+
+int FontConfigDirect::Open(unsigned fileid) {
+    SkAutoMutexAcquire ac(mutex_);
+    const std::map<unsigned, std::string>::const_iterator
+        i = fileid_to_filename_.find(fileid);
+    if (i == fileid_to_filename_.end())
+        return -1;
+
+    return open(i->second.c_str(), O_RDONLY);
+}
diff --git a/skia/ext/SkFontHost_fontconfig_direct.h b/skia/ext/SkFontHost_fontconfig_direct.h
new file mode 100644
index 0000000..d9c934a
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_direct.h
@@ -0,0 +1,44 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.h
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#ifndef FontConfigDirect_DEFINED
+#define FontConfigDirect_DEFINED
+
+#include <map>
+#include <string>
+
+#include "SkThread.h"
+#include "SkFontHost_fontconfig_impl.h"
+
+class FontConfigDirect : public FontConfigInterface {
+  public:
+    FontConfigDirect();
+
+    // FontConfigInterface implementation. Thread safe.
+    virtual bool Match(std::string* result_family, unsigned* result_fileid,
+                       bool fileid_valid, unsigned fileid,
+                       const std::string& family, int is_bold, int is_italic);
+    virtual int Open(unsigned fileid);
+
+  private:
+    SkMutex mutex_;
+    std::map<unsigned, std::string> fileid_to_filename_;
+    std::map<std::string, unsigned> filename_to_fileid_;
+    unsigned next_file_id_;
+};
+
+#endif  // FontConfigDirect_DEFINED
diff --git a/skia/ext/SkFontHost_fontconfig_impl.h b/skia/ext/SkFontHost_fontconfig_impl.h
new file mode 100644
index 0000000..a593891
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_impl.h
@@ -0,0 +1,60 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_impl.h
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+/* The SkFontHost_fontconfig code requires an implementation of an abstact
+ * fontconfig interface. We do this because sometimes fontconfig is not
+ * directly availible and this provides an ability to change the fontconfig
+ * implementation at run-time.
+ */
+
+#ifndef FontConfigInterface_DEFINED
+#define FontConfigInterface_DEFINED
+
+#include <string>
+
+class FontConfigInterface {
+  public:
+    virtual ~FontConfigInterface() { }
+
+    /** Performs config match
+     *
+     *  @param result_family (output) on success, the resulting family name.
+     *  @param result_fileid (output) on success, the resulting file id.
+     *  @param fileid_valid if true, then |fileid| is valid
+     *  @param fileid the fileid (as returned by this function) which we are
+     *    trying to match.
+     *  @param family (optional) the family of the font that we are trying to
+     *    match.
+     *  @param is_bold (optional, set to -1 to ignore)
+     *  @param is_italic (optional, set to -1 to ignore)
+     *  @return true iff successful.
+     */
+    virtual bool Match(
+          std::string* result_family,
+          unsigned* result_fileid,
+          bool fileid_valid,
+          unsigned fileid,
+          const std::string& family,
+          int is_bold,
+          int is_italic) = 0;
+
+    /** Open a font file given the fileid as returned by Match
+     */
+    virtual int Open(unsigned fileid) = 0;
+};
+
+#endif  // FontConfigInterface_DEFINED
diff --git a/skia/ext/SkFontHost_fontconfig_ipc.cpp b/skia/ext/SkFontHost_fontconfig_ipc.cpp
new file mode 100644
index 0000000..e9ca692
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_ipc.cpp
@@ -0,0 +1,164 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.cpp
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+// http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+
+#include "SkFontHost_fontconfig_ipc.h"
+
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/uio.h>
+
+FontConfigIPC::FontConfigIPC(int fd)
+    : fd_(fd) {
+}
+
+FontConfigIPC::~FontConfigIPC() {
+    close(fd_);
+}
+
+static ssize_t SyncIPC(int fd, const struct iovec* output, unsigned output_len,
+                       int* result_fd, const struct iovec* input,
+                       unsigned input_len) {
+    char cmsg_buf[CMSG_SPACE(sizeof(int))];
+
+    int fds[2];
+    if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds) == -1)
+        return false;
+
+    struct msghdr msg = {0};
+    msg.msg_iov = const_cast<struct iovec*>(input);
+    msg.msg_iovlen = input_len;
+    msg.msg_control = cmsg_buf;
+    msg.msg_controllen = sizeof(cmsg_buf);
+
+    struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
+    cmsg->cmsg_level = SOL_SOCKET;
+    cmsg->cmsg_type = SCM_RIGHTS;
+    cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+    *(int *) CMSG_DATA(cmsg) = fds[1];
+    msg.msg_controllen = cmsg->cmsg_len;
+
+    ssize_t r;
+    do {
+      r = sendmsg(fd, &msg, 0);
+    } while (r == -1 && errno == EINTR);
+    close(fds[1]);
+
+    if (r == -1) {
+        close(fds[0]);
+        return -1;
+    }
+
+    memset(&msg, 0, sizeof(msg));
+
+    msg.msg_iov = const_cast<struct iovec*>(output);
+    msg.msg_iovlen = output_len;
+    msg.msg_control = cmsg_buf;
+    msg.msg_controllen = sizeof(cmsg_buf);
+
+    do {
+        r = recvmsg(fds[0], &msg, 0);
+    } while (r == -1 && errno == EINTR);
+    close(fds[0]);
+
+    if (r == -1 || msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))
+        return -1;
+
+    cmsg = CMSG_FIRSTHDR(&msg);
+    if (cmsg && cmsg->cmsg_level == SOL_SOCKET &&
+        cmsg->cmsg_type == SCM_RIGHTS) {
+        const int fd = *(int*) CMSG_DATA(cmsg);
+        if (!result_fd)
+            close(fd);
+        *result_fd = fd;
+    }
+
+    return r;
+}
+
+bool FontConfigIPC::Match(std::string* result_family,
+                          unsigned* result_fileid,
+                          bool fileid_valid, unsigned fileid,
+                          const std::string& family, int is_bold,
+                          int is_italic) {
+    MatchRequest request;
+    request.method = METHOD_MATCH;
+    request.fileid_valid = fileid_valid;
+    request.fileid = fileid;
+    request.is_bold = is_bold;
+    request.is_italic = is_italic;
+
+    if (family.size() > 255)
+        return false;
+    request.family_len = family.size();
+
+    struct iovec out_iov[2];
+    out_iov[0].iov_base = &request;
+    out_iov[0].iov_len = sizeof(request);
+    if (family.size()) {
+        out_iov[1].iov_base = const_cast<char*>(family.data());
+        out_iov[1].iov_len = family.size();
+    }
+
+    MatchReply reply;
+    char filename_buf[PATH_MAX];
+
+    struct iovec in_iov[2];
+    in_iov[0].iov_base = &reply;
+    in_iov[0].iov_len = sizeof(reply);
+    in_iov[1].iov_base = filename_buf;
+    in_iov[1].iov_len = sizeof(filename_buf);
+
+    const ssize_t r = SyncIPC(fd_, in_iov, 2, NULL, out_iov,
+                              family.size() ? 2 : 1);
+
+    if (r == -1 || r < sizeof(reply))
+        return false;
+
+    if (reply.result == 0)
+        return false;
+
+    *result_fileid = reply.result_fileid;
+    if (r != sizeof(reply) + reply.filename_len)
+        return false;
+    if (result_family)
+      *result_family = std::string(filename_buf, reply.filename_len);
+
+    return true;
+}
+
+int FontConfigIPC::Open(unsigned fileid) {
+    OpenRequest request;
+    OpenReply reply;
+    const struct iovec out_iov = {&request, sizeof(request)};
+    const struct iovec in_iov = {&reply, sizeof(reply)};
+    int result_fd = -1;
+
+    request.method = METHOD_OPEN;
+    request.fileid = fileid;
+    const ssize_t r = SyncIPC(fd_, &in_iov, 1, &result_fd, &out_iov, 1);
+    if (r == -1 || r != sizeof(reply) || reply.result == 0) {
+        if (result_fd >= 0)
+            close(result_fd);
+        return -1;
+    }
+
+    return result_fd;
+}
diff --git a/skia/ext/SkFontHost_fontconfig_ipc.h b/skia/ext/SkFontHost_fontconfig_ipc.h
new file mode 100644
index 0000000..4436df7
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_ipc.h
@@ -0,0 +1,74 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.h
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#ifndef FontConfigIPC_DEFINED
+#define FontConfigIPC_DEFINED
+
+// http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+
+#include <map>
+#include <string>
+
+#include "SkFontHost_fontconfig_impl.h"
+
+class FontConfigIPC : public FontConfigInterface {
+  public:
+    FontConfigIPC(int fd);
+    ~FontConfigIPC();
+
+    // FontConfigInterface implementation.
+    virtual bool Match(std::string* result_family, unsigned* result_fileid,
+                       bool fileid_valid, unsigned fileid,
+                       const std::string& family, int is_bold, int is_italic);
+    virtual int Open(unsigned fileid);
+
+    enum Method {
+        METHOD_MATCH = 0,
+        METHOD_OPEN = 1,
+    };
+
+    struct MatchRequest {
+        uint16_t method;
+        uint8_t fileid_valid;
+        uint32_t fileid;
+        int8_t is_bold;
+        int8_t is_italic;
+        uint8_t family_len;
+        // char family[0] follows.
+    };
+
+    struct MatchReply {
+        uint8_t result;
+        uint32_t result_fileid;
+        uint16_t filename_len;
+        // char filename[0] follows.
+    };
+
+    struct OpenRequest {
+        uint16_t method;
+        unsigned fileid;
+    };
+
+    struct OpenReply {
+        uint8_t result;
+    };
+
+  private:
+    const int fd_;
+};
+
+#endif  // FontConfigIPC_DEFINED
diff --git a/skia/skia.gyp b/skia/skia.gyp
index 9c3ad85..220b382 100644
--- a/skia/skia.gyp
+++ b/skia/skia.gyp
@@ -358,7 +358,6 @@
         '../third_party/skia/src/ports/SkFontHost_FreeType.cpp',
         #'../third_party/skia/src/ports/SkFontHost_android.cpp',
         #'../third_party/skia/src/ports/SkFontHost_ascender.cpp',
-        '../third_party/skia/src/ports/SkFontHost_fontconfig.cpp',
         '../third_party/skia/src/ports/SkFontHost_tables.cpp',
         #'../third_party/skia/src/ports/SkFontHost_gamma.cpp',
         '../third_party/skia/src/ports/SkFontHost_gamma_none.cpp',
@@ -563,8 +562,6 @@
             '../third_party/skia/src/ports/SkFontHost_FreeType.cpp',
             '../third_party/skia/src/ports/SkFontHost_TryeType_Tables.cpp',
             '../third_party/skia/src/ports/SkFontHost_gamma_none.cpp',
-            '../third_party/skia/src/ports/SkFontHost_fontconfig.cpp',
-            '../third_party/skia/src/ports/SkFontHost_gamma_none.cpp',
             '../third_party/skia/src/ports/SkFontHost_tables.cpp',
             '../third_party/skia/src/core/SkTypeface.cpp',
           ],
@@ -592,6 +589,12 @@
             '../third_party/skia/src/ports/SkFontHost_none.cpp',
             'ext/SkTypeface_fake.cpp',
           ],
+          'sources': [
+            # http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+            'ext/SkFontHost_fontconfig.cpp',
+            'ext/SkFontHost_fontconfig_direct.cpp',
+            'ext/SkFontHost_fontconfig_ipc.cpp',
+          ],
           'export_dependent_settings': [
             '../third_party/harfbuzz/harfbuzz.gyp:harfbuzz',
             '../third_party/harfbuzz/harfbuzz.gyp:harfbuzz_interface',
@@ -624,6 +627,7 @@
           'config',
           '../third_party/skia/include/core',
           '../third_party/skia/include/effects',
+          '../third_party/skia/include/ports',
           'ext',
         ],
       },
diff --git a/webkit/webkit.gyp b/webkit/webkit.gyp
index f1ac224..6ec347e 100644
--- a/webkit/webkit.gyp
+++ b/webkit/webkit.gyp
@@ -515,6 +515,7 @@
             '../third_party/WebKit/WebCore/css/html4.css',
             '../third_party/WebKit/WebCore/css/quirks.css',
             '../third_party/WebKit/WebCore/css/view-source.css',
+            '../third_party/WebKit/WebCore/css/themeChromiumLinux.css',
             '../third_party/WebKit/WebCore/css/themeWin.css',
             '../third_party/WebKit/WebCore/css/themeWinQuirks.css',
             '../third_party/WebKit/WebCore/css/svg.css',