[Linux] Use PR_SET_NO_NEW_PRIVS by default in base/process/launch.h.

sandbox/linux/suid/sandbox.c

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox
 
 #include "common/sandbox.h"
 
 #define _GNU_SOURCE
 #include <asm/unistd.h>
@@ skipping 285 matching lines @@
 
       break;
     }
 
     // If EINVAL then the system doesn't support the requested flags, so
     // continue to try a different set.
     // On any other errno value the system *does* support these flags but
     // something went wrong, hence we bail with an error message rather then
     // provide less security.
     if (errno != EINVAL) {
+      fprintf(stderr, "Failed to move to new namespace:");
       if (kCloneExtraFlags[i] & CLONE_NEWPID) {
-        fprintf(stderr, " PID namespaces supported");
+        fprintf(stderr, " PID namespaces supported,");
       }
       if (kCloneExtraFlags[i] & CLONE_NEWNET) {
-        fprintf(stderr, " Network namespace supported");
+        fprintf(stderr, " Network namespace supported,");
       }
-      fprintf(stderr, "but failed: errno = %s\n", strerror(clone_errno));
+      fprintf(stderr, " but failed: errno = %s\n", strerror(clone_errno));
       return false;
     }
   }
 
   // If the system doesn't support NEWPID then we carry on anyway.
   return true;
 }
 
 static bool DropRoot() {
   if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0)) {
@@ skipping 156 matching lines @@
         !endptr || *endptr || errno != 0)
       return 1;
     return AdjustOOMScore(pid, score);
   }
 
   // Protect the core setuid sandbox functionality with an API version
   if (!CheckAndExportApiVersion()) {
     return 1;
   }
 
+  if (geteuid() != 0) {
+    fprintf(stderr, "The setuid sandbox is not running as root. Did the parent "

[jln (very slow on Chromium), 2014/04/02 19:06:55]

Nit: s/the parent/a parent/ ?

[Robert Sesek, 2014/04/02 19:57:05]

Done.

+                    "process prctl(PR_SET_NO_NEW_PRIVS, ...)?\n");

[jln (very slow on Chromium), 2014/04/02 19:06:55]

Could you add something such as: "Are you using a debugger?" (which is the most
common case for this problem).

[Robert Sesek, 2014/04/02 19:57:05]

Done.

+  }
+
   if (!MoveToNewNamespaces())
     return 1;
   if (!SpawnChrootHelper())
     return 1;
   if (!DropRoot())
     return 1;
   if (!SetupChildEnvironment())
     return 1;
 
   execv(argv[1], &argv[1]);
   FatalError("execv failed");
 
   return 1;
 }