Add a ForkWithFlags wrapper using the libc clone wrapper.

Add a ForkWithFlags wrapper using the libc clone wrapper.

sys_clone directly invokes the syscall, which does not update
libc's PID cache in the child. Although the libc wrapper function
updates the PID cache, it unfortunately requires that the child run on a
different stack, even if CLONE_VM is not specified. We work around this
by briefly switching stacks in the child, then using longjmp to switch
back. This gives us a version of clone with fork-like behavior, which is
what we need for starting processes in new namespaces.

This is a 2nd attempt at crrev.com/801033002, which caused failures
under valgrind and FORTIFY_SOURCE.

BUG=312380, 442817, 442912
Committed: https://crrev.com/9eb564175dbd452196f782da2b28e3e8e79c49a5
Cr-Commit-Position: refs/heads/master@{#308744}

[rickyz (no longer on Chrome), 2014-12-17 02:12:57]

rickyz@chromium.org changed reviewers:
+ jln@chromium.org, mdempsky@chromium.org

[rickyz (no longer on Chrome), 2014-12-17 02:13:24]

All right, here's a 2nd attempt of ForkWithFlags with Valgrind and
FORTIFY_SOURCE workarounds.

[jln (very slow on Chromium), 2014-12-17 02:23:42]

lgtm with a few nits.

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
File sandbox/linux/services/syscall_wrappers.cc (right):

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:73: namespace {
It's not typical to have multiple anonymous namespace. Let's just move
everything to the previous one?

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:82: // switch back to the original
stack so the child can return from sys_clone.
Nit: let's move this comment above the function definition (and change it
slightly to match that).

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:93: // upwards.
Nit: add a https://crbug.com/ link

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:125: if (!CloneArgumentsValid(flags,
ptid, ctid)) {
This should be above, no? (And run also on Valgrind)

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
File sandbox/linux/services/syscall_wrappers.h (right):

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.h:44: // pid cache may be incorrect
after this function is called under Valgrind.
Nit: document ptid / ctid.

[rickyz (no longer on Chrome), 2014-12-17 02:31:34]

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
File sandbox/linux/services/syscall_wrappers.cc (right):

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:73: namespace {
On 2014/12/17 02:23:42, jln wrote:
> It's not typical to have multiple anonymous namespace. Let's just move
> everything to the previous one?

Done.

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:82: // switch back to the original
stack so the child can return from sys_clone.
On 2014/12/17 02:23:42, jln wrote:
> Nit: let's move this comment above the function definition (and change it
> slightly to match that).

Done.

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:93: // upwards.
On 2014/12/17 02:23:42, jln wrote:
> Nit: add a https://crbug.com/ link

Done.

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:125: if (!CloneArgumentsValid(flags,
ptid, ctid)) {
On 2014/12/17 02:23:42, jln wrote:
> This should be above, no? (And run also on Valgrind)
Oops, I had left it below since sys_clone has the same check, but yeah, this
makes more sense at the top.

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.cc:125: if (!CloneArgumentsValid(flags,
ptid, ctid)) {
On 2014/12/17 02:23:42, jln wrote:
> This should be above, no? (And run also on Valgrind)

Done.

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
File sandbox/linux/services/syscall_wrappers.h (right):

https://codereview.chromium.org/800183004/diff/1/sandbox/linux/services/sysca...
sandbox/linux/services/syscall_wrappers.h:44: // pid cache may be incorrect
after this function is called under Valgrind.
On 2014/12/17 02:23:42, jln wrote:
> Nit: document ptid / ctid.

Done (just folded it into the prev sentence).

[rickyz (no longer on Chrome), 2014-12-17 03:43:18]

The CQ bit was checked by rickyz@chromium.org

[commit-bot: I haz the power, 2014-12-17 03:44:18]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/800183004/20001

[commit-bot: I haz the power, 2014-12-17 04:33:30]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2014-12-17 04:34:18]

Patchset 2 (id:??) landed as
https://crrev.com/9eb564175dbd452196f782da2b28e3e8e79c49a5
Cr-Commit-Position: refs/heads/master@{#308744}