Remove the open directory fd check.

sandbox/linux/services/credentials.h

Index: sandbox/linux/services/credentials.h
diff --git a/sandbox/linux/services/credentials.h b/sandbox/linux/services/credentials.h
index c6a6eb007151c634a93aba7e9b0706fdf00328de..1c3d271df5e012c65b81aa326e94b5e5d0dc846a 100644
--- a/sandbox/linux/services/credentials.h
+++ b/sandbox/linux/services/credentials.h
@@ -14,6 +14,7 @@
 #include <string>
 
 #include "base/basictypes.h"
+#include "base/compiler_specific.h"
 #include "base/memory/scoped_ptr.h"
 #include "sandbox/sandbox_export.h"
 
@@ -29,7 +30,7 @@ class SANDBOX_EXPORT Credentials {
 
   // Drop all capabilities in the effective, inheritable and permitted sets for
   // the current process.
-  bool DropAllCapabilities();
+  bool DropAllCapabilities() WARN_UNUSED_RESULT;
   // Return true iff there is any capability in any of the capabilities sets
   // of the current process.
   bool HasAnyCapability() const;
@@ -51,7 +52,7 @@ class SANDBOX_EXPORT Credentials {
   // change.
   // If this call succeeds, the current process will be granted a full set of
   // capabilities in the new namespace.
-  bool MoveToNewUserNS();
+  bool MoveToNewUserNS() WARN_UNUSED_RESULT;
 
   // Remove the ability of the process to access the file system. File
   // descriptors which are already open prior to calling this API remain
@@ -60,9 +61,9 @@ class SANDBOX_EXPORT Credentials {
   // CAP_SYS_CHROOT can be acquired by using the MoveToNewUserNS() API.
   // Make sure to call DropAllCapabilities() after this call to prevent
   // escapes.
-  // To be secure, it's very important for this API to not be called while the
-  // process has any directory file descriptor open.
-  bool DropFileSystemAccess();
+  // To be secure, the caller must ensure that any directory file descriptors
+  // are closed. Otherwise it may be possible to escape the chroot.
+  bool DropFileSystemAccess() WARN_UNUSED_RESULT;

[jln (very slow on Chromium), 2015/01/05 23:02:32]

Could you point to ProcUtil::HasOpenDirectory() as a way to do that?

[rickyz (no longer on Chrome), 2015/01/06 08:01:20]

Done.

 
  private:
   DISALLOW_COPY_AND_ASSIGN(Credentials);