Allow the seccomp sandbox to be enabled, even if the suid sandbox has...

sandbox/linux/seccomp/open.cc

 #include "debug.h"
 #include "sandbox_impl.h"
 
 namespace playground {
 
 int Sandbox::sandbox_open(const char *pathname, int flags, mode_t mode) {
   Debug::syscall(__NR_open, "Executing handler");
   size_t len                    = strlen(pathname);
   struct Request {
     int       sysnum;
@@ skipping 12 matching lines @@
 
   long rc;
   SysCalls sys;
   if (write(sys, processFdPub(), request, sizeof(data)) != (int)sizeof(data) ||
       read(sys, threadFdPub(), &rc, sizeof(rc)) != sizeof(rc)) {
     die("Failed to forward open() request [sandbox]");
   }
   return static_cast<int>(rc);
 }
 
-bool Sandbox::process_open(int parentProc, int sandboxFd, int threadFdPub,
+bool Sandbox::process_open(int parentMapsFd, int sandboxFd, int threadFdPub,
                            int threadFd, SecureMem::Args* mem) {
   // Read request
   SysCalls sys;
   Open open_req;
   if (read(sys, sandboxFd, &open_req, sizeof(open_req)) != sizeof(open_req)) {
  read_parm_failed:
     die("Failed to read parameters for open() [process]");
   }
   int   rc                  = -ENAMETOOLONG;
   if (open_req.path_length >= sizeof(mem->pathname)) {
@@ skipping 19 matching lines @@
     char tmp[open_req.path_length];
     if (read(sys, sandboxFd, tmp, open_req.path_length) !=
         (ssize_t)open_req.path_length) {
       goto read_parm_failed;
     }
     Debug::message(("Denying access to \"" + std::string(tmp) + "\"").c_str());
     SecureMem::abandonSystemCall(threadFd, -EACCES);
     return false;
   }
 
-  SecureMem::lockSystemCall(parentProc, mem);
+  SecureMem::lockSystemCall(parentMapsFd, mem);
   if (read(sys, sandboxFd, mem->pathname, open_req.path_length) !=
       (ssize_t)open_req.path_length) {
     goto read_parm_failed;
   }
   mem->pathname[open_req.path_length] = '\000';
 
   // TODO(markus): Implement sandboxing policy. For now, we allow read
   // access to everything. That's probably not correct.
   Debug::message(("Allowing access to \"" + std::string(mem->pathname) +
                   "\"").c_str());
 
   // Tell trusted thread to open the file.
-  SecureMem::sendSystemCall(threadFdPub, true, parentProc, mem, __NR_open,
+  SecureMem::sendSystemCall(threadFdPub, true, parentMapsFd, mem, __NR_open,
                             mem->pathname - (char*)mem + (char*)mem->self,
                             open_req.flags, open_req.mode);
   return true;
 }
 
 } // namespace