Don't use no_new_privs mode when running NM process on Linux

chrome/browser/extensions/api/messaging/native_process_launcher_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/messaging/native_process_launcher.h"
 
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/process/launch.h"
+#include "build/build_config.h"
 #include "chrome/common/chrome_paths.h"
 
 namespace extensions {
 
 namespace {
 
 base::FilePath FindManifestInDir(int dir_key, const std::string& host_name) {
   base::FilePath base_path;
   if (PathService::Get(dir_key, &base_path)) {
     base::FilePath path = base_path.Append(host_name + ".json");
@@ skipping 43 matching lines @@
   if (HANDLE_EINTR(pipe(write_pipe_fds)) != 0) {
     LOG(ERROR) << "Bad write pipe";
     return false;
   }
   base::ScopedFD write_pipe_read_fd(write_pipe_fds[0]);
   base::ScopedFD write_pipe_write_fd(write_pipe_fds[1]);
   fd_map.push_back(std::make_pair(write_pipe_read_fd.get(), STDIN_FILENO));
 
   base::LaunchOptions options;
   options.fds_to_remap = &fd_map;
+
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+  // Don't use no_new_privs mode, e.g. in case the host needs to use sudo.
+  options.allow_new_privs = true;
+#endif
+
   if (!base::LaunchProcess(command_line, options, process_handle)) {
     LOG(ERROR) << "Error launching process";
     return false;
   }
 
   // We will not be reading from the write pipe, nor writing from the read pipe.
   write_pipe_read_fd.reset();
   read_pipe_write_fd.reset();
 
   *read_file = base::File(read_pipe_read_fd.release());
   *write_file = base::File(write_pipe_write_fd.release());
 
   return true;
 }
 
 }  // namespace extensions