Do not use suid helper when using the namespace sandbox.

content/browser/zygote_host/zygote_host_impl_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/zygote_host/zygote_host_impl_linux.h"
 
 #include <errno.h>
 #include <string.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
@@ skipping 141 matching lines @@
 
   const bool using_namespace_sandbox = ShouldUseNamespaceSandbox();
   // A non empty sandbox_cmd means we want a SUID sandbox.
   const bool using_suid_sandbox =
       !sandbox_cmd.empty() && !using_namespace_sandbox;
 
   // Use the SUID sandbox for adjusting OOM scores when we are using the setuid
   // or namespace sandbox. This is needed beacuse the processes are
   // non-dumpable, so /proc/pid/oom_score_adj can only be written by root.
   use_suid_sandbox_for_adj_oom_score_ =
-      !sandbox_binary_.empty() &&
-      (using_namespace_sandbox || using_suid_sandbox);
+      !sandbox_binary_.empty() && using_suid_sandbox;
 
   // Start up the sandbox host process and get the file descriptor for the
   // renderers to talk to it.
   const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket();
   fds_to_map.push_back(std::make_pair(sfd, GetSandboxFD()));
 
   base::ScopedFD dummy_fd;
   if (using_suid_sandbox) {
     scoped_ptr<sandbox::SetuidSandboxHost> sandbox_host(
         sandbox::SetuidSandboxHost::Create());
@@ skipping 421 matching lines @@
   }
 
   if (!sandbox::Credentials::CanCreateProcessInNewUserNS()) {
     return false;
   }
 
   return true;
 }
 
 }  // namespace content