Linux sandbox: handle ENOSPC clone failure

sandbox/linux/services/credentials.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <limits.h>
 #include <signal.h>
 #include <stddef.h>
@@ skipping 114 matching lines @@
   PCHECK(HANDLE_EINTR(waitpid(pid, &status, 0)) == pid);
 
   return WIFEXITED(status) && WEXITSTATUS(status) == kExitSuccess;
 }
 
 // CHECK() that an attempt to move to a new user namespace raised an expected
 // errno.
 void CheckCloneNewUserErrno(int error) {
   // EPERM can happen if already in a chroot. EUSERS if too many nested
   // namespaces are used. EINVAL for kernels that don't support the feature.
-  // Valgrind will ENOSYS unshare().
+  // Valgrind will ENOSYS unshare().  ENOSPC can occur when the system has
+  // reached its maximum configured number of user namespaces.
   PCHECK(error == EPERM || error == EUSERS || error == EINVAL ||
-         error == ENOSYS);
+         error == ENOSYS || error == ENOSPC);
 }
 
 // Converts a Capability to the corresponding Linux CAP_XXX value.
 int CapabilityToKernelValue(Credentials::Capability cap) {
   switch (cap) {
     case Credentials::Capability::SYS_CHROOT:
       return CAP_SYS_CHROOT;
     case Credentials::Capability::SYS_ADMIN:
       return CAP_SYS_ADMIN;
   }
@@ skipping 199 matching lines @@
   if (pid != 0) {
     return pid;
   }
 
   // Since we just forked, we are single threaded.
   PCHECK(DropAllCapabilitiesOnCurrentThread());
   return 0;
 }
 
 }  // namespace sandbox.