Set allow_new_privs when launching CRD host controller from the NM process.

remoting/host/setup/daemon_controller_delegate_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/setup/daemon_controller_delegate_linux.h"
 
 #include <unistd.h>
 
 #include "base/base_paths.h"
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/environment.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/md5.h"
 #include "base/path_service.h"
 #include "base/process/kill.h"
 #include "base/process/launch.h"
 #include "base/process/process_handle.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/thread_task_runner_handle.h"
 #include "base/values.h"
+#include "build/build_config.h"
 #include "net/base/net_util.h"
 #include "remoting/host/host_config.h"
 #include "remoting/host/json_host_config.h"
 #include "remoting/host/usage_stats_consent.h"
 
 namespace remoting {
 
 namespace {
 
 const char kDaemonScript[] =
@@ skipping 55 matching lines @@
   }
   base::ProcessHandle process_handle;
 
   // Redirect the child's stdout to the parent's stderr. In the case where this
   // parent process is a Native Messaging host, its stdout is used to send
   // messages to the web-app.
   base::FileHandleMappingVector fds_to_remap;
   fds_to_remap.push_back(std::pair<int, int>(STDERR_FILENO, STDOUT_FILENO));
   base::LaunchOptions options;
   options.fds_to_remap = &fds_to_remap;
+
+#if !defined(OS_CHROMEOS)
+  options.allow_new_privs = true;
+#endif
+
   if (!base::LaunchProcess(command_line, options, &process_handle)) {
     LOG(ERROR) << "Failed to run command: "
                << command_line.GetCommandLineString();
     return false;
   }
 
   if (!base::WaitForExitCodeWithTimeout(process_handle, exit_code, timeout)) {
     base::KillProcess(process_handle, 0, false);
     LOG(ERROR) << "Timeout exceeded for command: "
                << command_line.GetCommandLineString();
@@ skipping 204 matching lines @@
   return consent;
 }
 
 scoped_refptr<DaemonController> DaemonController::Create() {
   scoped_ptr<DaemonController::Delegate> delegate(
       new DaemonControllerDelegateLinux());
   return new DaemonController(delegate.Pass());
 }
 
 }  // namespace remoting