Set a new TLS when using CLONE_VM.

sandbox/linux/services/credentials_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <fcntl.h>
+#include <pthread.h>
 #include <stdio.h>
 #include <sys/capability.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <vector>
 
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
@@ skipping 211 matching lines @@
 
   const cap_value_t allowed_cap = CAP_SYS_CHROOT;
   for (const cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) {
     PCHECK(cap_set_flag(expected_cap.get(), flag, 1, &allowed_cap, CAP_SET) ==
            0);
   }
 
   CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get()));
 }
 
+// Disabled on ASAN because of crbug.com/451603.
+SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(DropFileSystemAccessPreservesTLS)) {
+  // Probably missing kernel support.
+  if (!Credentials::MoveToNewUserNS()) return;
+  CHECK(Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get()));
+
+  // In glibc, pthread_getattr_np makes an assertion about the cached PID/TID in
+  // TLS.
+  pthread_attr_t attr;
+  EXPECT_EQ(0, pthread_getattr_np(pthread_self(), &attr));
+}
+

[jln (very slow on Chromium), 2015/07/21 23:39:17]

Could you add another test that creates a thread that looks at getpid() and
sys_gettid() and checks that they're ok?

[rickyz (no longer on Chrome), 2015/07/22 04:00:32]

Sorry, I wasn't quite sure what kind of test you were thinking about. If I
create another thread, it'll have its own TLS, and the cached tid should be
correct there. Even if the cached pid is incorrectly set to -1, getpid() will
make a getpid syscall and update the cached value, so we wouldn't be able to
tell that anything was amiss.

[jln (very slow on Chromium), 2015/07/22 17:30:06]

Yeah, sorry I meant another "thread" with the vfork() we're doing. But that
would require quite a bit of work to expose that stuff to testing and we don't
really want to run too much code in that "thread" anyways.

Is there anything we could test with raise() ? I vaguely remember raise() using
some of the cached values in the TCB/PCB.

 }  // namespace.
 
 }  // namespace sandbox.