Add sandbox support (issue #524).

- The sandbox is now enabled by default on all platforms. Use the CefSettings.no_sandbox option or the "no-sandbox" command-line flag to disable sandbox support.
- Windows: See cef_sandbox_win.h for requirements to enable sandbox support.
- Windows: If Visual Studio isn't installed in the standard location set the CEF_VCVARS environment variable before running make_distrib.py or automate.py (see msvs_env.bat).
- Linux: For binary distributions a new chrome-sandbox executable with SUID permissions must be placed next to the CEF executable. See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for details on setting up the development environment when building CEF from source code.

git-svn-id: https://chromiumembedded.googlecode.com/svn/trunk@1518 5089003a-bbd8-11dd-ad1f-f1f9622dbc98

libcef/common/main_delegate.cc

@@ -166,15 +166,26 @@ bool CefMainDelegate::BasicStartupComplete(int* exit_code) {
     if (settings.single_process)
       command_line->AppendSwitch(switches::kSingleProcess);
 
+    bool no_sandbox = settings.no_sandbox;
+
     if (settings.browser_subprocess_path.length > 0) {
       base::FilePath file_path =
           base::FilePath(CefString(&settings.browser_subprocess_path));
       if (!file_path.empty()) {
         command_line->AppendSwitchPath(switches::kBrowserSubprocessPath,
                                        file_path);
+
+#if defined(OS_WIN)
+        // The sandbox is not supported when using a separate subprocess
+        // executable on Windows.
+        no_sandbox = true;
+#endif
       }
     }
 
+    if (no_sandbox)
+      command_line->AppendSwitch(switches::kNoSandbox);
+
     if (settings.user_agent.length > 0) {
       command_line->AppendSwitchASCII(switches::kUserAgent,
           CefString(&settings.user_agent));
@@ -267,10 +278,6 @@ bool CefMainDelegate::BasicStartupComplete(int* exit_code) {
       command_line->AppendSwitchASCII(switches::kContextSafetyImplementation,
           base::IntToString(settings.context_safety_implementation));
     }
-
-    // TODO(cef): Figure out how to support the sandbox.
-    if (!command_line->HasSwitch(switches::kNoSandbox))
-      command_line->AppendSwitch(switches::kNoSandbox);
   }
 
   if (content_client_.application().get()) {