Remove NEWNS from the setuid sandbox....

sandbox/linux/suid/sandbox.c

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox
 
 #define _GNU_SOURCE
 #include <asm/unistd.h>
 #include <errno.h>
 #include <fcntl.h>
@@ skipping 18 matching lines @@
 #include "linux_util.h"
 #include "process_util.h"
 #include "suid_unsafe_environment_variables.h"
 
 #if !defined(CLONE_NEWPID)
 #define CLONE_NEWPID 0x20000000
 #endif
 #if !defined(CLONE_NEWNET)
 #define CLONE_NEWNET 0x40000000
 #endif
-#if !defined(CLONE_NEWNS)
-#define CLONE_NEWNS 0x00020000
-#endif
 
 #if !defined(BTRFS_SUPER_MAGIC)
 #define BTRFS_SUPER_MAGIC 0x9123683E
 #endif
 #if !defined(EXT2_SUPER_MAGIC)
 #define EXT2_SUPER_MAGIC 0xEF53
 #endif
 #if !defined(EXT3_SUPER_MAGIC)
 #define EXT3_SUPER_MAGIC 0xEF53
 #endif
@@ skipping 210 matching lines @@
     close(chroot_signal_fd);
     return false;
   }
 
   return true;
 }
 
 static bool MoveToNewNamespaces() {
   // These are the sets of flags which we'll try, in order.
   const int kCloneExtraFlags[] = {
-    CLONE_NEWPID | CLONE_NEWNET | CLONE_NEWNS,
     CLONE_NEWPID | CLONE_NEWNET,
     CLONE_NEWPID,
   };
 
   for (size_t i = 0;
        i < sizeof(kCloneExtraFlags) / sizeof(kCloneExtraFlags[0]);
        i++) {
     pid_t pid = syscall(__NR_clone, SIGCHLD | kCloneExtraFlags[i], 0, 0, 0);
 
     if (pid > 0)
@@ skipping 141 matching lines @@
   if (!DropRoot())
     return 1;
   if (!SetupChildEnvironment())
     return 1;
 
   execv(argv[1], &argv[1]);
   FatalError("execv failed");
 
   return 1;
 }