Mac: Scaffolding for sandboxing GPU process.

The sandbox config allows everything for now; I will put in restrictions in a follow-up CL (which should be small).

This CL should have no visible effect (other than changing a few LOG(WARNING) to LOG(ERROR)).

BUG=48607
TEST=GPU process still works

Review URL: http://codereview.chromium.org/5491001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@67939 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 29 insertions, 2 deletions

diff --git a/chrome/gpu/gpu_main.cc b/chrome/gpu/gpu_main.cc
index 29e59ec..53a0017 100644
--- a/chrome/gpu/gpu_main.cc
+++ b/chrome/gpu/gpu_main.cc
@@ -25,6 +25,10 @@
 #include "chrome/app/breakpad_linux.h"
 #endif
 
+#if defined(OS_MACOSX)
+#include "chrome/common/sandbox_mac.h"
+#endif
+
 #if defined(OS_WIN)
 #include "app/win_util.h"
 #endif
@@ -33,8 +37,6 @@
 #include "gfx/gtk_util.h"
 #endif
 
-namespace {
-
 // 1% per watchdog trial group.
 const int kFieldTrialSize = 1;
 
@@ -42,6 +44,20 @@ const int kFieldTrialSize = 1;
 const int kMinGpuTimeout = 5;
 const int kMaxGpuTimeout = 20;
 
+namespace {
+
+bool InitializeGpuSandbox() {
+#if defined(OS_MACOSX)
+  CommandLine* parsed_command_line = CommandLine::ForCurrentProcess();
+  SandboxInitWrapper sandbox_wrapper;
+  return sandbox_wrapper.InitializeSandbox(*parsed_command_line,
+                                           switches::kGpuProcess);
+#else
+  // TODO(port): Create GPU sandbox for linux and windows.
+  return true;
+#endif
+}
+
 }  // namespace
 
 // Main function for starting the Gpu process.
@@ -82,6 +98,17 @@ int GpuMain(const MainFunctionParams& parameters) {
   gfx::GtkInitFromCommandLine(command_line);
 #endif
 
+  // Note that kNoSandbox will also disable the GPU sandbox.
+  bool no_gpu_sandbox = command_line.HasSwitch(switches::kNoGpuSandbox);
+  if (!no_gpu_sandbox) {
+    if (!InitializeGpuSandbox()) {
+      LOG(ERROR) << "Failed to initialize the GPU sandbox";
+      return EXIT_FAILURE;
+    }
+  } else {
+    LOG(ERROR) << "Running without GPU sandbox";
+  }
+
   // Load the GL implementation and locate the bindings before starting the GPU
   // watchdog because this can take a lot of time and the GPU watchdog might
   // terminate the GPU process.