Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

sandbox/linux/suid/client/setuid_sandbox_client.cc

Index: sandbox/linux/suid/client/setuid_sandbox_client.cc
diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
index ca73d46444e12e386fbd9bed5c99fbcad382ed71..107d7c964cc56ff9b7c579d29fe4e8230ee19321 100644
--- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
+++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
@@ -22,8 +22,8 @@
 namespace {
 
 bool IsFileSystemAccessDenied() {
-  base::ScopedFD root_dir(HANDLE_EINTR(open("/", O_RDONLY)));
-  return !root_dir.is_valid();
+  base::ScopedFD proc_self_exe(HANDLE_EINTR(open("/proc/self/exe", O_RDONLY)));

[mdempsky, 2017/01/10 22:48:23]

Since we decided to not support root+sandbox, can we revert this back to "/"?

[Tom (Use chromium acct), 2017/01/10 23:32:03]

Unfortunately no, since the dialog box gets shown after the sandbox is set up

[mdempsky, 2017/01/11 22:20:15]

That is unfortunate. Can you at least add a comment mentioning we would rather
check "/", but that gives false positives when running as root and reference
this CL?

+  return !proc_self_exe.is_valid();
 }
 
 int GetHelperApi(base::Environment* env) {