Start all children in their own PID namespace.

content/common/sandbox_linux/sandbox_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dirent.h>
 #include <fcntl.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
@@ skipping 168 matching lines @@
   // Check being in a new PID namespace created by the namespace sandbox and
   // being the init process.
   CHECK(sandbox::NamespaceSandbox::InNewPidNamespace());
   const pid_t pid = getpid();
   CHECK_EQ(1, pid);
 
   CHECK(sandbox::Credentials::MoveToNewUserNS());
   // Note: this requires SealSandbox() to be called later in this process to be
   // safe, as this class is keeping a file descriptor to /proc/.
   CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_));
-  CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd_));
+
+  // We do not drop CAP_SYS_ADMIN because we need it to place each child process
+  // in its own PID namespace later on.
+  std::vector<sandbox::Credentials::Capability> caps;
+  caps.push_back(sandbox::Credentials::Capability::SYS_ADMIN);
+  CHECK(sandbox::Credentials::SetCapabilities(proc_fd_, caps));
 
   // This needs to happen after moving to a new user NS, since doing so involves
   // writing the UID/GID map.
   CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers());
 }
 
 std::vector<int> LinuxSandbox::GetFileDescriptorsToClose() {
   std::vector<int> fds;
   if (proc_fd_ >= 0) {
     fds.push_back(proc_fd_);
@@ skipping 249 matching lines @@
 
 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const {
   DCHECK(thread);
   base::ScopedFD proc_fd(OpenProc(proc_fd_));
   PCHECK(proc_fd.is_valid());
   CHECK(
       sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_fd.get(), thread));
 }
 
 }  // namespace content