Demo: Build NamespaceSandbox::ForkInNewPidNamespace.

sandbox/linux/services/namespace_sandbox.h

Index: sandbox/linux/services/namespace_sandbox.h
diff --git a/sandbox/linux/services/namespace_sandbox.h b/sandbox/linux/services/namespace_sandbox.h
index 80097fb16afa625415070e8e581540e514e67abf..d7785ad83a6e596262d6439b521fdaf8f7c1d23b 100644
--- a/sandbox/linux/services/namespace_sandbox.h
+++ b/sandbox/linux/services/namespace_sandbox.h
@@ -52,20 +52,6 @@ class SANDBOX_EXPORT NamespaceSandbox {
   static base::Process LaunchProcess(const std::vector<std::string>& argv,
                                      const base::LaunchOptions& options);
 
-  // Forks a process in its own PID namespace. The child process is the init
-  // process inside of the PID namespace, so if the child needs to fork further,
-  // it should call CreateInitProcessReaper, which turns the init process into a
-  // reaper process.
-  //
-  // Otherwise, the child should setup handlers for signals which should
-  // terminate the process using InstallDefaultTerminationSignalHandlers or
-  // InstallTerminationSignalHandler. This works around the fact that init
-  // processes ignore such signals unless they have an explicit handler set.
-  //
-  // This function requries CAP_SYS_ADMIN. If |drop_capabilities_in_child| is
-  // true, then capabilities are dropped in the child.
-  static pid_t ForkInNewPidNamespace(bool drop_capabilities_in_child);
-
   // Installs a signal handler for:
   //
   // SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2
@@ -85,6 +71,20 @@ class SANDBOX_EXPORT NamespaceSandbox {
   static bool InstallTerminationSignalHandler(int sig, int exit_code);
 #endif  // !defined(OS_NACL_NONSFI)
 
+  // Forks a process in its own PID namespace. The child process is the init
+  // process inside of the PID namespace, so if the child needs to fork further,
+  // it should call CreateInitProcessReaper, which turns the init process into a
+  // reaper process.
+  //
+  // Otherwise, the child should setup handlers for signals which should
+  // terminate the process using InstallDefaultTerminationSignalHandlers or
+  // InstallTerminationSignalHandler. This works around the fact that init
+  // processes ignore such signals unless they have an explicit handler set.
+  //
+  // This function requries CAP_SYS_ADMIN. If |drop_capabilities_in_child| is
+  // true, then capabilities are dropped in the child.
+  static pid_t ForkInNewPidNamespace(bool drop_capabilities_in_child);
+
   // Returns whether the namespace sandbox created a new user, PID, and network
   // namespace. In particular, InNewUserNamespace should return true iff the
   // process was started via this class.