Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc

Index: chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc
diff --git a/chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc b/chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc
index 83f63ce3010d37aee1e3ccb4a461ceca194fabbd..56f739a02946beec73554eb633159387caf82fe4 100644
--- a/chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc
+++ b/chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc
@@ -76,11 +76,6 @@ void ChromeBrowserMainExtraPartsViews::PreProfileInit() {
   if (getuid() != 0)
     return;
 
-  const base::CommandLine& command_line =

[sky, 2017/01/05 23:21:59]

Can you update the description to indicate why we want to allow user-data-dir
now?

[Tom (Use chromium acct), 2017/01/06 00:18:38]

Updated the CL description.
This change disallows --user-data-dir

-      *base::CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kUserDataDir))
-    return;
-
   base::string16 title = l10n_util::GetStringFUTF16(
       IDS_REFUSE_TO_RUN_AS_ROOT, l10n_util::GetStringUTF16(IDS_PRODUCT_NAME));
   base::string16 message = l10n_util::GetStringFUTF16(