Update sandbox/linux from upstream

sandbox/linux/services/credentials_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
 #include <stdio.h>
 #include <sys/capability.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <vector>
 
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
@@ skipping 211 matching lines @@
 
   const cap_value_t allowed_cap = CAP_SYS_CHROOT;
   for (const cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) {
     PCHECK(cap_set_flag(expected_cap.get(), flag, 1, &allowed_cap, CAP_SET) ==
            0);
   }
 
   CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get()));
 }
 
+volatile sig_atomic_t signal_handler_called;
+void SignalHandler(int sig) {
+  signal_handler_called = 1;
+}
+
+// Disabled on ASAN because of crbug.com/451603.
+SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(DropFileSystemAccessPreservesTLS)) {
+  // Probably missing kernel support.
+  if (!Credentials::MoveToNewUserNS()) return;
+  CHECK(Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get()));
+
+  // In glibc, pthread_getattr_np makes an assertion about the cached PID/TID in
+  // TLS.
+  pthread_attr_t attr;
+  EXPECT_EQ(0, pthread_getattr_np(pthread_self(), &attr));
+
+  // raise also uses the cached TID in glibc.
+  struct sigaction action = {};
+  action.sa_handler = &SignalHandler;
+  PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0);
+
+  PCHECK(raise(SIGUSR1) == 0);
+  CHECK_EQ(1, signal_handler_called);
+}
+
 }  // namespace.
 
 }  // namespace sandbox.