Remove the open directory fd check.

sandbox/linux/services/credentials.cc

Index: sandbox/linux/services/credentials.cc
diff --git a/sandbox/linux/services/credentials.cc b/sandbox/linux/services/credentials.cc
index f926ce8e85dcc117dabf85ece4f8581c728b94f7..e97dff8d9b52599ac83725c0cfe8699ffe6fdd6f 100644
--- a/sandbox/linux/services/credentials.cc
+++ b/sandbox/linux/services/credentials.cc
@@ -21,7 +21,6 @@
 #include "base/template_util.h"
 #include "base/third_party/valgrind/valgrind.h"
 #include "base/threading/thread.h"
-#include "sandbox/linux/services/proc_util.h"
 #include "sandbox/linux/services/syscall_wrappers.h"
 
 namespace {
@@ -248,9 +247,6 @@ bool Credentials::MoveToNewUserNS() {
 }
 
 bool Credentials::DropFileSystemAccess() {

[jln (very slow on Chromium), 2015/01/05 23:02:32]

We could also take a file descriptor to /proc here as an argument and pass it to
HasOpenDirectory() (which does ignore it from the list).

The function would still allow "-1" as an argument, so doesn't become harder to
use in the trivial case.

WDYT?

[rickyz (no longer on Chrome), 2015/01/06 08:01:20]

Hm, having the check isn't as big of an extra guarantee as it was before, since
the caller would still needs to remember to close the /proc fd at some point in
the future - I think it would be more flexible to expect the caller to call
ProcUtil::HasOpenDirectory right before they close the /proc fd.

I could probably be convinced either way if you feel strongly about it though.

-  // Chrooting to a safe empty dir will only be safe if no directory file
-  // descriptor is available to the process.
-  DCHECK(!ProcUtil::HasOpenDirectory(-1));
   return ChrootToSafeEmptyDir();
 }