Linux: Add support for chrooted renderers.

http://code.google.com/p/chromium/wiki/LinuxSandboxIPC

Without filesystem access from the renderers, we need another way of
dealing with fontconfig and font loading.

This add support for:
  * An "SBX_D" environment variable in the renderers which is used to
    signal the end of dynamic linking so that the chroot can be
    enforced.
  * A sandbox_host process, running outside the sandbox, to deal with
    fontconfig requests from the renderers. See the wiki page for
    the reasoning behind making it a separate process.
  * A new, custom SkFontHost for Skia. Because this is Chrome
    specific, it will live outside the upstream Skia tree. This
    FontHost can be configured either to drive fontconfig directly
    (for the browser process and for any unsandboxed renderers) or to
    use an IPC system. Since the same SkFontHost has to be linked into
    both the browser and renderer (they are the same binary), this
    switch has to be made at run time.

Sandbox IPC calls are rare (a couple of dozen at page load time) and
add about 50us of overhead for each call.

http://codereview.chromium.org/112074
BUG=8081


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@17575 0039d316-1c4b-4281-b951-d872f2087c98

7 files changed, 765 insertions, 3 deletions

diff --git a/skia/ext/SkFontHost_fontconfig.cpp b/skia/ext/SkFontHost_fontconfig.cpp
new file mode 100644
index 0000000..780bc60
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig.cpp
@@ -0,0 +1,236 @@
+/* libs/graphics/ports/SkFontHost_fontconfig.cpp
+**
+** Copyright 2008, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+// -----------------------------------------------------------------------------
+// This file provides implementations of the font resolution members of
+// SkFontHost by using the fontconfig[1] library. Fontconfig is usually found
+// on Linux systems and handles configuration, parsing and caching issues
+// involved with enumerating and matching fonts.
+//
+// [1] http://fontconfig.org
+// -----------------------------------------------------------------------------
+
+#include <map>
+#include <string>
+
+#include <unistd.h>
+#include <sys/stat.h>
+
+#include "SkFontHost.h"
+#include "SkStream.h"
+#include "SkFontHost_fontconfig_impl.h"
+#include "SkFontHost_fontconfig_direct.h"
+#include "SkFontHost_fontconfig_ipc.h"
+
+static FontConfigInterface* global_fc_impl = NULL;
+
+void SkiaFontConfigUseDirectImplementation() {
+    if (global_fc_impl)
+      delete global_fc_impl;
+    global_fc_impl = new FontConfigDirect;
+}
+
+void SkiaFontConfigUseIPCImplementation(int fd) {
+    if (global_fc_impl)
+      delete global_fc_impl;
+    global_fc_impl = new FontConfigIPC(fd);
+}
+
+static void init() __attribute__((constructor));
+static void init() {
+  SkiaFontConfigUseDirectImplementation();
+}
+
+static SkMutex global_fc_map_lock;
+static std::map<uint32_t, SkTypeface *> global_fc_typefaces;
+
+// This is the maximum size of the font cache.
+static const unsigned kFontCacheMemoryBudget = 2 * 1024 * 1024;  // 2MB
+
+// UniqueIds are encoded as (fileid << 8) | style
+
+static unsigned UniqueIdToFileId(unsigned uniqueid)
+{
+    return uniqueid >> 8;
+}
+
+static SkTypeface::Style UniqueIdToStyle(unsigned uniqueid)
+{
+    return static_cast<SkTypeface::Style>(uniqueid & 0xff);
+}
+
+static unsigned FileIdAndStyleToUniqueId(unsigned fileid,
+                                         SkTypeface::Style style)
+{
+    SkASSERT(style & 0xff == style);
+    return (fileid << 8) | static_cast<int>(style);
+}
+
+class FontConfigTypeface : public SkTypeface {
+public:
+    FontConfigTypeface(Style style, uint32_t id)
+        : SkTypeface(style, id)
+    { }
+};
+
+// static
+SkTypeface* SkFontHost::CreateTypeface(const SkTypeface* familyFace,
+                                       const char familyName[],
+                                       SkTypeface::Style style)
+{
+    std::string resolved_family_name;
+
+    if (familyFace) {
+        // Given the fileid we can ask fontconfig for the familyname of the
+        // font.
+        const unsigned fileid = UniqueIdToFileId(familyFace->uniqueID());
+        if (!global_fc_impl->Match(
+          &resolved_family_name, NULL, true /* fileid valid */, fileid, "",
+          -1, -1)) {
+            return NULL;
+        }
+    } else if (familyName) {
+        resolved_family_name = familyName;
+    } else {
+        return NULL;
+    }
+
+    const bool bold = style & SkTypeface::kBold;
+    const bool italic = style & SkTypeface::kItalic;
+    unsigned fileid;
+    if (!global_fc_impl->Match(NULL, &fileid, false, -1, /* no fileid */
+                               resolved_family_name, bold, italic)) {
+        return NULL;
+    }
+
+    const unsigned id = FileIdAndStyleToUniqueId(fileid, style);
+    SkTypeface* typeface = SkNEW_ARGS(FontConfigTypeface, (style, id));
+
+    {
+        SkAutoMutexAcquire ac(global_fc_map_lock);
+        global_fc_typefaces[id] = typeface;
+    }
+
+    return typeface;
+}
+
+// static
+SkTypeface* SkFontHost::CreateTypefaceFromStream(SkStream* stream)
+{
+    SkASSERT(!"SkFontHost::CreateTypefaceFromStream unimplemented");
+    return NULL;
+}
+
+// static
+SkTypeface* SkFontHost::CreateTypefaceFromFile(const char path[])
+{
+    SkASSERT(!"SkFontHost::CreateTypefaceFromFile unimplemented");
+    return NULL;
+}
+
+// static
+bool SkFontHost::ValidFontID(SkFontID uniqueID) {
+    SkAutoMutexAcquire ac(global_fc_map_lock);
+    return global_fc_typefaces.find(uniqueID) != global_fc_typefaces.end();
+}
+
+void SkFontHost::Serialize(const SkTypeface*, SkWStream*) {
+    SkASSERT(!"SkFontHost::Serialize unimplemented");
+}
+
+SkTypeface* SkFontHost::Deserialize(SkStream* stream) {
+    SkASSERT(!"SkFontHost::Deserialize unimplemented");
+    return NULL;
+}
+
+// static
+uint32_t SkFontHost::NextLogicalFont(SkFontID fontID) {
+    // We don't handle font fallback, WebKit does.
+    return 0;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+
+class SkFileDescriptorStream : public SkStream {
+  public:
+    SkFileDescriptorStream(int fd)
+        : fd_(fd) {
+    }
+
+    ~SkFileDescriptorStream() {
+        close(fd_);
+    }
+
+    virtual bool rewind() {
+        if (lseek(fd_, 0, SEEK_SET) == -1)
+            return false;
+        return true;
+    }
+
+    // SkStream implementation.
+    virtual size_t read(void* buffer, size_t size) {
+        if (!buffer && !size) {
+            // This is request for the length of the stream.
+            struct stat st;
+            if (fstat(fd_, &st) == -1)
+                return 0;
+            return st.st_size;
+        }
+
+        if (!buffer) {
+            // This is a request to skip bytes.
+            const off_t current_position = lseek(fd_, 0, SEEK_CUR);
+            if (current_position == -1)
+                return 0;
+            const off_t new_position = lseek(fd_, size, SEEK_CUR);
+            if (new_position == -1)
+                return 0;
+            if (new_position < current_position) {
+                lseek(fd_, current_position, SEEK_SET);
+                return 0;
+            }
+            return new_position;
+        }
+
+        // This is a request to read bytes.
+        return ::read(fd_, buffer, size);
+    }
+
+  private:
+    const int fd_;
+};
+
+///////////////////////////////////////////////////////////////////////////////
+
+// static
+SkStream* SkFontHost::OpenStream(uint32_t id)
+{
+    const unsigned fileid = UniqueIdToFileId(id);
+    const int fd = global_fc_impl->Open(fileid);
+    if (fd < 0)
+        return NULL;
+
+    return SkNEW_ARGS(SkFileDescriptorStream, (fd));
+}
+
+size_t SkFontHost::ShouldPurgeFontCache(size_t sizeAllocatedSoFar)
+{
+    if (sizeAllocatedSoFar > kFontCacheMemoryBudget)
+        return sizeAllocatedSoFar - kFontCacheMemoryBudget;
+    else
+        return 0;   // nothing to do
+}
diff --git a/skia/ext/SkFontHost_fontconfig_direct.cpp b/skia/ext/SkFontHost_fontconfig_direct.cpp
new file mode 100644
index 0000000..001fccd
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_direct.cpp
@@ -0,0 +1,180 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.cpp
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#include "SkFontHost_fontconfig_direct.h"
+
+#include <unistd.h>
+#include <fcntl.h>
+
+#include <fontconfig/fontconfig.h>
+
+FontConfigDirect::FontConfigDirect()
+    : next_file_id_(0) {
+  FcInit();
+}
+
+// -----------------------------------------------------------------------------
+// Normally we only return exactly the font asked for. In last-resort cases,
+// the request is for one of the basic font names "Sans", "Serif" or
+// "Monospace". This function tells you whether a given request is for such a
+// fallback.
+// -----------------------------------------------------------------------------
+static bool IsFallbackFontAllowed(const std::string& family)
+{
+    return family == "Sans" ||
+           family == "Serif" ||
+           family == "Monospace";
+}
+
+bool FontConfigDirect::Match(std::string* result_family,
+                             unsigned* result_fileid,
+                             bool fileid_valid, unsigned fileid,
+                             const std::string& family, int is_bold,
+                             int is_italic) {
+    SkAutoMutexAcquire ac(mutex_);
+    FcPattern* pattern = FcPatternCreate();
+
+    FcValue fcvalue;
+    if (fileid_valid) {
+        const std::map<unsigned, std::string>::const_iterator
+            i = fileid_to_filename_.find(fileid);
+        if (i == fileid_to_filename_.end()) {
+            FcPatternDestroy(pattern);
+            return false;
+        }
+
+        fcvalue.type = FcTypeString;
+        fcvalue.u.s = (FcChar8*) i->second.c_str();
+        FcPatternAdd(pattern, FC_FILE, fcvalue, 0);
+    }
+    if (!family.empty()) {
+        fcvalue.type = FcTypeString;
+        fcvalue.u.s = (FcChar8*) family.c_str();
+        FcPatternAdd(pattern, FC_FAMILY, fcvalue, 0);
+    }
+    if (is_bold > 0) {
+        fcvalue.type = FcTypeInteger;
+        fcvalue.u.i = is_bold ? FC_WEIGHT_BOLD : FC_WEIGHT_NORMAL;
+        FcPatternAdd(pattern, FC_WEIGHT, fcvalue, 0);
+    }
+    if (is_italic > 0) {
+        fcvalue.type = FcTypeInteger;
+        fcvalue.u.i = is_bold ? FC_SLANT_ITALIC : FC_SLANT_ROMAN;
+        FcPatternAdd(pattern, FC_SLANT, fcvalue, 0);
+    }
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    // Font matching:
+    // CSS often specifies a fallback list of families:
+    //    font-family: a, b, c, serif;
+    // However, fontconfig will always do its best to find *a* font when asked
+    // for something so we need a way to tell if the match which it has found is
+    // "good enough" for us. Otherwise, we can return NULL which gets piped up
+    // and lets WebKit know to try the next CSS family name. However, fontconfig
+    // configs allow substitutions (mapping "Arial -> Helvetica" etc) and we
+    // wish to support that.
+    //
+    // Thus, if a specific family is requested we set @family_requested. Then we
+    // record two strings: the family name after config processing and the
+    // family name after resolving. If the two are equal, it's a good match.
+    //
+    // So consider the case where a user has mapped Arial to Helvetica in their
+    // config.
+    //    requested family: "Arial"
+    //    post_config_family: "Helvetica"
+    //    post_match_family: "Helvetica"
+    //      -> good match
+    //
+    // and for a missing font:
+    //    requested family: "Monaco"
+    //    post_config_family: "Monaco"
+    //    post_match_family: "Times New Roman"
+    //      -> BAD match
+    //
+    // However, we special-case fallback fonts; see IsFallbackFontAllowed().
+    FcChar8* post_config_family;
+    FcPatternGetString(pattern, FC_FAMILY, 0, &post_config_family);
+
+    FcResult result;
+    FcPattern* match = FcFontMatch(0, pattern, &result);
+    if (!match) {
+        FcPatternDestroy(pattern);
+        return false;
+    }
+
+    FcChar8* post_match_family;
+    FcPatternGetString(match, FC_FAMILY, 0, &post_match_family);
+    const bool family_names_match =
+        family.empty() ?
+        true :
+        strcasecmp((char *)post_config_family, (char *)post_match_family) == 0;
+
+    FcPatternDestroy(pattern);
+
+    if (!family_names_match && !IsFallbackFontAllowed(family)) {
+        FcPatternDestroy(match);
+        return false;
+    }
+
+    FcChar8* c_filename;
+    if (FcPatternGetString(match, FC_FILE, 0, &c_filename) != FcResultMatch) {
+        FcPatternDestroy(match);
+        return NULL;
+    }
+    const std::string filename((char *) c_filename);
+
+    unsigned out_fileid;
+    if (fileid_valid) {
+        out_fileid = fileid;
+    } else {
+        const std::map<std::string, unsigned>::const_iterator
+            i = filename_to_fileid_.find(filename);
+        if (i == filename_to_fileid_.end()) {
+            out_fileid = next_file_id_++;
+            filename_to_fileid_[filename] = out_fileid;
+            fileid_to_filename_[out_fileid] = filename;
+        } else {
+            out_fileid = i->second;
+        }
+    }
+
+    if (*result_fileid)
+        *result_fileid = out_fileid;
+
+    FcChar8* c_family;
+    if (FcPatternGetString(match, FC_FAMILY, 0, &c_family)) {
+        FcPatternDestroy(match);
+        return NULL;
+    }
+
+    if (result_family)
+        *result_family = (char *) c_family;
+
+    return true;
+}
+
+int FontConfigDirect::Open(unsigned fileid) {
+    SkAutoMutexAcquire ac(mutex_);
+    const std::map<unsigned, std::string>::const_iterator
+        i = fileid_to_filename_.find(fileid);
+    if (i == fileid_to_filename_.end())
+        return -1;
+
+    return open(i->second.c_str(), O_RDONLY);
+}
diff --git a/skia/ext/SkFontHost_fontconfig_direct.h b/skia/ext/SkFontHost_fontconfig_direct.h
new file mode 100644
index 0000000..d9c934a
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_direct.h
@@ -0,0 +1,44 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.h
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#ifndef FontConfigDirect_DEFINED
+#define FontConfigDirect_DEFINED
+
+#include <map>
+#include <string>
+
+#include "SkThread.h"
+#include "SkFontHost_fontconfig_impl.h"
+
+class FontConfigDirect : public FontConfigInterface {
+  public:
+    FontConfigDirect();
+
+    // FontConfigInterface implementation. Thread safe.
+    virtual bool Match(std::string* result_family, unsigned* result_fileid,
+                       bool fileid_valid, unsigned fileid,
+                       const std::string& family, int is_bold, int is_italic);
+    virtual int Open(unsigned fileid);
+
+  private:
+    SkMutex mutex_;
+    std::map<unsigned, std::string> fileid_to_filename_;
+    std::map<std::string, unsigned> filename_to_fileid_;
+    unsigned next_file_id_;
+};
+
+#endif  // FontConfigDirect_DEFINED
diff --git a/skia/ext/SkFontHost_fontconfig_impl.h b/skia/ext/SkFontHost_fontconfig_impl.h
new file mode 100644
index 0000000..a593891
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_impl.h
@@ -0,0 +1,60 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_impl.h
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+/* The SkFontHost_fontconfig code requires an implementation of an abstact
+ * fontconfig interface. We do this because sometimes fontconfig is not
+ * directly availible and this provides an ability to change the fontconfig
+ * implementation at run-time.
+ */
+
+#ifndef FontConfigInterface_DEFINED
+#define FontConfigInterface_DEFINED
+
+#include <string>
+
+class FontConfigInterface {
+  public:
+    virtual ~FontConfigInterface() { }
+
+    /** Performs config match
+     *
+     *  @param result_family (output) on success, the resulting family name.
+     *  @param result_fileid (output) on success, the resulting file id.
+     *  @param fileid_valid if true, then |fileid| is valid
+     *  @param fileid the fileid (as returned by this function) which we are
+     *    trying to match.
+     *  @param family (optional) the family of the font that we are trying to
+     *    match.
+     *  @param is_bold (optional, set to -1 to ignore)
+     *  @param is_italic (optional, set to -1 to ignore)
+     *  @return true iff successful.
+     */
+    virtual bool Match(
+          std::string* result_family,
+          unsigned* result_fileid,
+          bool fileid_valid,
+          unsigned fileid,
+          const std::string& family,
+          int is_bold,
+          int is_italic) = 0;
+
+    /** Open a font file given the fileid as returned by Match
+     */
+    virtual int Open(unsigned fileid) = 0;
+};
+
+#endif  // FontConfigInterface_DEFINED
diff --git a/skia/ext/SkFontHost_fontconfig_ipc.cpp b/skia/ext/SkFontHost_fontconfig_ipc.cpp
new file mode 100644
index 0000000..e9ca692
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_ipc.cpp
@@ -0,0 +1,164 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.cpp
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+// http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+
+#include "SkFontHost_fontconfig_ipc.h"
+
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/uio.h>
+
+FontConfigIPC::FontConfigIPC(int fd)
+    : fd_(fd) {
+}
+
+FontConfigIPC::~FontConfigIPC() {
+    close(fd_);
+}
+
+static ssize_t SyncIPC(int fd, const struct iovec* output, unsigned output_len,
+                       int* result_fd, const struct iovec* input,
+                       unsigned input_len) {
+    char cmsg_buf[CMSG_SPACE(sizeof(int))];
+
+    int fds[2];
+    if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds) == -1)
+        return false;
+
+    struct msghdr msg = {0};
+    msg.msg_iov = const_cast<struct iovec*>(input);
+    msg.msg_iovlen = input_len;
+    msg.msg_control = cmsg_buf;
+    msg.msg_controllen = sizeof(cmsg_buf);
+
+    struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
+    cmsg->cmsg_level = SOL_SOCKET;
+    cmsg->cmsg_type = SCM_RIGHTS;
+    cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+    *(int *) CMSG_DATA(cmsg) = fds[1];
+    msg.msg_controllen = cmsg->cmsg_len;
+
+    ssize_t r;
+    do {
+      r = sendmsg(fd, &msg, 0);
+    } while (r == -1 && errno == EINTR);
+    close(fds[1]);
+
+    if (r == -1) {
+        close(fds[0]);
+        return -1;
+    }
+
+    memset(&msg, 0, sizeof(msg));
+
+    msg.msg_iov = const_cast<struct iovec*>(output);
+    msg.msg_iovlen = output_len;
+    msg.msg_control = cmsg_buf;
+    msg.msg_controllen = sizeof(cmsg_buf);
+
+    do {
+        r = recvmsg(fds[0], &msg, 0);
+    } while (r == -1 && errno == EINTR);
+    close(fds[0]);
+
+    if (r == -1 || msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))
+        return -1;
+
+    cmsg = CMSG_FIRSTHDR(&msg);
+    if (cmsg && cmsg->cmsg_level == SOL_SOCKET &&
+        cmsg->cmsg_type == SCM_RIGHTS) {
+        const int fd = *(int*) CMSG_DATA(cmsg);
+        if (!result_fd)
+            close(fd);
+        *result_fd = fd;
+    }
+
+    return r;
+}
+
+bool FontConfigIPC::Match(std::string* result_family,
+                          unsigned* result_fileid,
+                          bool fileid_valid, unsigned fileid,
+                          const std::string& family, int is_bold,
+                          int is_italic) {
+    MatchRequest request;
+    request.method = METHOD_MATCH;
+    request.fileid_valid = fileid_valid;
+    request.fileid = fileid;
+    request.is_bold = is_bold;
+    request.is_italic = is_italic;
+
+    if (family.size() > 255)
+        return false;
+    request.family_len = family.size();
+
+    struct iovec out_iov[2];
+    out_iov[0].iov_base = &request;
+    out_iov[0].iov_len = sizeof(request);
+    if (family.size()) {
+        out_iov[1].iov_base = const_cast<char*>(family.data());
+        out_iov[1].iov_len = family.size();
+    }
+
+    MatchReply reply;
+    char filename_buf[PATH_MAX];
+
+    struct iovec in_iov[2];
+    in_iov[0].iov_base = &reply;
+    in_iov[0].iov_len = sizeof(reply);
+    in_iov[1].iov_base = filename_buf;
+    in_iov[1].iov_len = sizeof(filename_buf);
+
+    const ssize_t r = SyncIPC(fd_, in_iov, 2, NULL, out_iov,
+                              family.size() ? 2 : 1);
+
+    if (r == -1 || r < sizeof(reply))
+        return false;
+
+    if (reply.result == 0)
+        return false;
+
+    *result_fileid = reply.result_fileid;
+    if (r != sizeof(reply) + reply.filename_len)
+        return false;
+    if (result_family)
+      *result_family = std::string(filename_buf, reply.filename_len);
+
+    return true;
+}
+
+int FontConfigIPC::Open(unsigned fileid) {
+    OpenRequest request;
+    OpenReply reply;
+    const struct iovec out_iov = {&request, sizeof(request)};
+    const struct iovec in_iov = {&reply, sizeof(reply)};
+    int result_fd = -1;
+
+    request.method = METHOD_OPEN;
+    request.fileid = fileid;
+    const ssize_t r = SyncIPC(fd_, &in_iov, 1, &result_fd, &out_iov, 1);
+    if (r == -1 || r != sizeof(reply) || reply.result == 0) {
+        if (result_fd >= 0)
+            close(result_fd);
+        return -1;
+    }
+
+    return result_fd;
+}
diff --git a/skia/ext/SkFontHost_fontconfig_ipc.h b/skia/ext/SkFontHost_fontconfig_ipc.h
new file mode 100644
index 0000000..4436df7
--- /dev/null
+++ b/skia/ext/SkFontHost_fontconfig_ipc.h
@@ -0,0 +1,74 @@
+/* libs/graphics/ports/SkFontHost_fontconfig_direct.h
+**
+** Copyright 2009, Google Inc.
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#ifndef FontConfigIPC_DEFINED
+#define FontConfigIPC_DEFINED
+
+// http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+
+#include <map>
+#include <string>
+
+#include "SkFontHost_fontconfig_impl.h"
+
+class FontConfigIPC : public FontConfigInterface {
+  public:
+    FontConfigIPC(int fd);
+    ~FontConfigIPC();
+
+    // FontConfigInterface implementation.
+    virtual bool Match(std::string* result_family, unsigned* result_fileid,
+                       bool fileid_valid, unsigned fileid,
+                       const std::string& family, int is_bold, int is_italic);
+    virtual int Open(unsigned fileid);
+
+    enum Method {
+        METHOD_MATCH = 0,
+        METHOD_OPEN = 1,
+    };
+
+    struct MatchRequest {
+        uint16_t method;
+        uint8_t fileid_valid;
+        uint32_t fileid;
+        int8_t is_bold;
+        int8_t is_italic;
+        uint8_t family_len;
+        // char family[0] follows.
+    };
+
+    struct MatchReply {
+        uint8_t result;
+        uint32_t result_fileid;
+        uint16_t filename_len;
+        // char filename[0] follows.
+    };
+
+    struct OpenRequest {
+        uint16_t method;
+        unsigned fileid;
+    };
+
+    struct OpenReply {
+        uint8_t result;
+    };
+
+  private:
+    const int fd_;
+};
+
+#endif  // FontConfigIPC_DEFINED
diff --git a/skia/skia.gyp b/skia/skia.gyp
index 9c3ad85..220b382 100644
--- a/skia/skia.gyp
+++ b/skia/skia.gyp
@@ -358,7 +358,6 @@
         '../third_party/skia/src/ports/SkFontHost_FreeType.cpp',
         #'../third_party/skia/src/ports/SkFontHost_android.cpp',
         #'../third_party/skia/src/ports/SkFontHost_ascender.cpp',
-        '../third_party/skia/src/ports/SkFontHost_fontconfig.cpp',
         '../third_party/skia/src/ports/SkFontHost_tables.cpp',
         #'../third_party/skia/src/ports/SkFontHost_gamma.cpp',
         '../third_party/skia/src/ports/SkFontHost_gamma_none.cpp',
@@ -563,8 +562,6 @@
             '../third_party/skia/src/ports/SkFontHost_FreeType.cpp',
             '../third_party/skia/src/ports/SkFontHost_TryeType_Tables.cpp',
             '../third_party/skia/src/ports/SkFontHost_gamma_none.cpp',
-            '../third_party/skia/src/ports/SkFontHost_fontconfig.cpp',
-            '../third_party/skia/src/ports/SkFontHost_gamma_none.cpp',
             '../third_party/skia/src/ports/SkFontHost_tables.cpp',
             '../third_party/skia/src/core/SkTypeface.cpp',
           ],
@@ -592,6 +589,12 @@
             '../third_party/skia/src/ports/SkFontHost_none.cpp',
             'ext/SkTypeface_fake.cpp',
           ],
+          'sources': [
+            # http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
+            'ext/SkFontHost_fontconfig.cpp',
+            'ext/SkFontHost_fontconfig_direct.cpp',
+            'ext/SkFontHost_fontconfig_ipc.cpp',
+          ],
           'export_dependent_settings': [
             '../third_party/harfbuzz/harfbuzz.gyp:harfbuzz',
             '../third_party/harfbuzz/harfbuzz.gyp:harfbuzz_interface',
@@ -624,6 +627,7 @@
           'config',
           '../third_party/skia/include/core',
           '../third_party/skia/include/effects',
+          '../third_party/skia/include/ports',
           'ext',
         ],
       },