Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

> Debian 8 restricts use of CLONE_NEWUSER to only processes with
> CAP_SYS_ADMIN. (https://github.com/semplice/linux/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch)
> Chrome was previously checking if the kernel supported CLONE_NEWUSER
> by running clone(CLONE_NEWUSER, ...) with the same capabilities chrome
> was launched with.  This leads to 2 scenarios:
>
> 1. If Chrome was run as root:
>    The check for CLONE_NEWUSER will succeed.  Chrome will then set up
>    the namespace sandbox by clone()'ing and dropping CAP_SYS_ADMIN.
>    Subsequent clone()'s with CLONE_NEWUSER will then fail.
>
> 2. If Chrome was run as a normal user:
>    The check for CLONE_NEWUSER will fail.  Chrome will fallback to
>    using the setuid sandbox.
>
> The solution is to simply drop CAP_SYS_ADMIN before the check.
>
> In addition, this CL disallows running Chromium as root unless launched
> with --no-sandbox.
>
> BUG=638180
>
> Review-Url: https://codereview.chromium.org/2578483002
> Cr-Commit-Position: refs/heads/master@{#443062}

NOTRY=true
NOPRESUBMIT=true
BUG=638180
TBR=sky@chromium.org,mdempsky@chromium.org

Review-Url: https://codereview.chromium.org/2641513004
Cr-Commit-Position: refs/branch-heads/2924@{#785}
Cr-Branched-From: 3a87aecc31cd1ffe751dd72c04e5a96a1fc8108a-refs/heads/master@{#433059}
Committed: https://chromium.googlesource.com/chromium/src/+/8b6103c5b1029b52feb6f34e2594d7e125a28f3e

[Tom (Use chromium acct), 2017-01-17 23:39:49]

Description was changed from

==========
Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

> Debian 8 restricts use of CLONE_NEWUSER to only processes with
> CAP_SYS_ADMIN.
(https://github.com/semplice/linux/blob/master/debian/patches/debian/add-sysct...)
> Chrome was previously checking if the kernel supported CLONE_NEWUSER
> by running clone(CLONE_NEWUSER, ...) with the same capabilities chrome
> was launched with.  This leads to 2 scenarios:
>
> 1. If Chrome was run as root:
>    The check for CLONE_NEWUSER will succeed.  Chrome will then set up
>    the namespace sandbox by clone()'ing and dropping CAP_SYS_ADMIN.
>    Subsequent clone()'s with CLONE_NEWUSER will then fail.
>
> 2. If Chrome was run as a normal user:
>    The check for CLONE_NEWUSER will fail.  Chrome will fallback to
>    using the setuid sandbox.
>
> The solution is to simply drop CAP_SYS_ADMIN before the check.
>
> In addition, this CL disallows running Chromium as root unless launched
> with --no-sandbox.
>
> BUG=638180
>
> Review-Url: https://codereview.chromium.org/2578483002
> Cr-Commit-Position: refs/heads/master@{#443062}

BUG=638180
TBR=sky@chromium.org,mdempsky@chromium.org
==========

to

==========
Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

> Debian 8 restricts use of CLONE_NEWUSER to only processes with
> CAP_SYS_ADMIN.
(https://github.com/semplice/linux/blob/master/debian/patches/debian/add-sysct...)
> Chrome was previously checking if the kernel supported CLONE_NEWUSER
> by running clone(CLONE_NEWUSER, ...) with the same capabilities chrome
> was launched with.  This leads to 2 scenarios:
>
> 1. If Chrome was run as root:
>    The check for CLONE_NEWUSER will succeed.  Chrome will then set up
>    the namespace sandbox by clone()'ing and dropping CAP_SYS_ADMIN.
>    Subsequent clone()'s with CLONE_NEWUSER will then fail.
>
> 2. If Chrome was run as a normal user:
>    The check for CLONE_NEWUSER will fail.  Chrome will fallback to
>    using the setuid sandbox.
>
> The solution is to simply drop CAP_SYS_ADMIN before the check.
>
> In addition, this CL disallows running Chromium as root unless launched
> with --no-sandbox.
>
> BUG=638180
>
> Review-Url: https://codereview.chromium.org/2578483002
> Cr-Commit-Position: refs/heads/master@{#443062}

NOTRY=true
NOPRESUBMIT=true
BUG=638180
TBR=sky@chromium.org,mdempsky@chromium.org
==========

[Tom (Use chromium acct), 2017-01-17 23:40:23]

sky@ + mdempsky@ PTAL/RS this merge

[mdempsky, 2017-01-17 23:45:40]

lgtm

[sky, 2017-01-17 23:52:38]

LGTM

[Tom (Use chromium acct), 2017-01-17 23:53:28]

The CQ bit was checked by thomasanderson@google.com

[commit-bot: I haz the power, 2017-01-17 23:53:54]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-17 23:57:50]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1484697208824720, "parent_rev":
"77ddb6126ff2f49a01fec01f80db0d70f5d9213e", "commit_rev":
"8b6103c5b1029b52feb6f34e2594d7e125a28f3e"}

[commit-bot: I haz the power, 2017-01-17 23:58:21]

Description was changed from

==========
Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

> Debian 8 restricts use of CLONE_NEWUSER to only processes with
> CAP_SYS_ADMIN.
(https://github.com/semplice/linux/blob/master/debian/patches/debian/add-sysct...)
> Chrome was previously checking if the kernel supported CLONE_NEWUSER
> by running clone(CLONE_NEWUSER, ...) with the same capabilities chrome
> was launched with.  This leads to 2 scenarios:
>
> 1. If Chrome was run as root:
>    The check for CLONE_NEWUSER will succeed.  Chrome will then set up
>    the namespace sandbox by clone()'ing and dropping CAP_SYS_ADMIN.
>    Subsequent clone()'s with CLONE_NEWUSER will then fail.
>
> 2. If Chrome was run as a normal user:
>    The check for CLONE_NEWUSER will fail.  Chrome will fallback to
>    using the setuid sandbox.
>
> The solution is to simply drop CAP_SYS_ADMIN before the check.
>
> In addition, this CL disallows running Chromium as root unless launched
> with --no-sandbox.
>
> BUG=638180
>
> Review-Url: https://codereview.chromium.org/2578483002
> Cr-Commit-Position: refs/heads/master@{#443062}

NOTRY=true
NOPRESUBMIT=true
BUG=638180
TBR=sky@chromium.org,mdempsky@chromium.org
==========

to

==========
Namespace sandbox: add check for unprivileged use of CLONE_NEWUSER

> Debian 8 restricts use of CLONE_NEWUSER to only processes with
> CAP_SYS_ADMIN.
(https://github.com/semplice/linux/blob/master/debian/patches/debian/add-sysct...)
> Chrome was previously checking if the kernel supported CLONE_NEWUSER
> by running clone(CLONE_NEWUSER, ...) with the same capabilities chrome
> was launched with.  This leads to 2 scenarios:
>
> 1. If Chrome was run as root:
>    The check for CLONE_NEWUSER will succeed.  Chrome will then set up
>    the namespace sandbox by clone()'ing and dropping CAP_SYS_ADMIN.
>    Subsequent clone()'s with CLONE_NEWUSER will then fail.
>
> 2. If Chrome was run as a normal user:
>    The check for CLONE_NEWUSER will fail.  Chrome will fallback to
>    using the setuid sandbox.
>
> The solution is to simply drop CAP_SYS_ADMIN before the check.
>
> In addition, this CL disallows running Chromium as root unless launched
> with --no-sandbox.
>
> BUG=638180
>
> Review-Url: https://codereview.chromium.org/2578483002
> Cr-Commit-Position: refs/heads/master@{#443062}

NOTRY=true
NOPRESUBMIT=true
BUG=638180
TBR=sky@chromium.org,mdempsky@chromium.org

Review-Url: https://codereview.chromium.org/2641513004
Cr-Commit-Position: refs/branch-heads/2924@{#785}
Cr-Branched-From:
3a87aecc31cd1ffe751dd72c04e5a96a1fc8108a-refs/heads/master@{#433059}
Committed:
https://chromium.googlesource.com/chromium/src/+/8b6103c5b1029b52feb6f34e2594...
==========

[commit-bot: I haz the power, 2017-01-17 23:58:22]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/chromium/src/+/8b6103c5b1029b52feb6f34e2594...