Linux: all the binary to be readable with the SUID sandbox.
Linux: all the binary to be readable with the SUID sandbox.

Previously, we required that the binary be non-readable. This causes the
kernel to mark the process as non-dumpable at startup. The thinking was
that, although we were putting the renderers into a PID namespace (with
the SUID sandbox), they would none the less be in the /same/ PID
namespace. So they could ptrace each other unless they were non-dumpable.

If the binary was readable, then there would be a window between process
startup and the point where we set the non-dumpable flag in which a
compromised renderer could ptrace attach.

However, now that we have a zygote model, only the (trusted) zygote
exists at this point and we can set the non-dumpable flag which is
inherited by all our renderer children.


git-svn-id: dd90618784b6a4b323ea0c23a071cb1c9e6f2ac7@20383 4ff67af0-8c30-449e-8e8b-ad334ec8d88c

wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser