NaCl: Add sanity check for number of open FDs at startup

sandbox/linux/services/credentials_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <sys/stat.h>
@@ skipping 39 matching lines @@
 
 // Give dynamic tools a simple thing to test.
 TEST(Credentials, CreateAndDestroy) {
   {
     Credentials cred1;
     (void) cred1;
   }
   scoped_ptr<Credentials> cred2(new Credentials);
 }
 
+TEST(Credentials, CountOpenFds) {
+  int proc_fd = open("/proc", O_RDONLY | O_DIRECTORY);
+  ASSERT_LE(0, proc_fd);
+  base::ScopedFD proc_fd_closer(proc_fd);

[jln (very slow on Chromium), 2014/05/09 23:55:24]

Now that ScopedFD have been rewritten, they're not longer "pure closers".

So simply do base::ScopedFD proc_fd(open(..));
and use proc_fd.get()

[Mark Seaborn, 2014/05/19 21:38:21]

Done.

+
+  Credentials creds;
+  int fd_count = creds.CountOpenFds(proc_fd);
+  int fd = open("/dev/null", O_RDONLY);
+  ASSERT_LE(0, fd);
+  EXPECT_EQ(fd_count + 1, creds.CountOpenFds(proc_fd));
+  ASSERT_EQ(0, close(fd));
+  EXPECT_EQ(fd_count, creds.CountOpenFds(proc_fd));
+}
+
 TEST(Credentials, HasOpenDirectory) {
   Credentials creds;
   // No open directory should exist at startup.
   EXPECT_FALSE(creds.HasOpenDirectory(-1));
   {
     // Have a "/dev" file descriptor around.
     int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY);
     base::ScopedFD dev_fd_closer(dev_fd);
     EXPECT_TRUE(creds.HasOpenDirectory(-1));
   }
@@ skipping 145 matching lines @@
 
   // The kernel should now prevent us from regaining capabilities because we
   // are in a chroot.
   CHECK(!Credentials::SupportsNewUserNS());
   CHECK(!creds.MoveToNewUserNS());
 }
 
 }  // namespace.
 
 }  // namespace sandbox.