Linux Sandbox: add Credentials::SupportsNewUserNS()

Linux Sandbox: add Credentials::SupportsNewUserNS()

We need to be able to check for unprivileged namespace support without
actually unsharing the current namespace.

We add a method that creates a new process with a new user namespace and
see if this succeeds.

BUG=312380
NOTRY=true

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=254433

[jln (very slow on Chromium), 2014-02-28 21:27:09]

Jorge, do you mind taking a look?

[mdempsky, 2014-02-28 22:44:59]

https://codereview.chromium.org/182453004/diff/30001/sandbox/linux/services/c...
File sandbox/linux/services/credentials.cc (right):

https://codereview.chromium.org/182453004/diff/30001/sandbox/linux/services/c...
sandbox/linux/services/credentials.cc:295: CheckCloneNewUserErrno();
Is the VLOG line guaranteed to not clobber errno?

[Jorge Lucangeli Obes, 2014-02-28 22:59:58]

lgtm % Matthew's comment.

https://codereview.chromium.org/182453004/diff/30001/sandbox/linux/services/c...
File sandbox/linux/services/credentials.cc (right):

https://codereview.chromium.org/182453004/diff/30001/sandbox/linux/services/c...
sandbox/linux/services/credentials.cc:30: bool IsRunningOnValgrind() { return
RUNNING_ON_VALGRIND; }
At some point we should make a header with these functions somewhere inside
sandbox/.

[jln (very slow on Chromium), 2014-02-28 23:30:18]

https://codereview.chromium.org/182453004/diff/30001/sandbox/linux/services/c...
File sandbox/linux/services/credentials.cc (right):

https://codereview.chromium.org/182453004/diff/30001/sandbox/linux/services/c...
sandbox/linux/services/credentials.cc:295: CheckCloneNewUserErrno();
On 2014/02/28 22:44:59, mdempsky_chromium wrote:
> Is the VLOG line guaranteed to not clobber errno?

Good point, that's a fragile construct. Fixed.

[jln (very slow on Chromium), 2014-03-01 00:02:07]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2014-03-01 00:04:04]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jln@chromium.org/182453004/50001

[commit-bot: I haz the power, 2014-03-01 01:09:45]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jln@chromium.org/182453004/50001

[commit-bot: I haz the power, 2014-03-01 01:30:57]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jln@chromium.org/182453004/50001

[commit-bot: I haz the power, 2014-03-01 01:36:35]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-03-01 01:36:35]

Try jobs failed on following builders: linux_chromium_chromeos_clang_dbg

[jln (very slow on Chromium), 2014-03-03 06:17:59]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2014-03-03 06:18:07]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jln@chromium.org/182453004/50001

[commit-bot: I haz the power, 2014-03-03 07:50:52]

Change committed as 254433