Linux Sandbox: move init processes to new session id.

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ skipping 72 matching lines @@
   CHECK(!IsSandboxed()) << "Unexpectedly sandboxed!";
 
   if (setuid_sandbox_client_->IsSuidSandboxChild()) {
     setuid_sandbox_client_->CloseDummyFile();
 
     // Make sure that no directory file descriptor is open, as it would bypass
     // the setuid sandbox model.
     CHECK(!HasOpenDirectory());
 
     // Get sandboxed.
+    CHECK(setuid_sandbox_client_->CreateNewSession());
     CHECK(setuid_sandbox_client_->ChrootMe());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   }
 }
 
 void NaClSandbox::CheckForExpectedNumberOfOpenFds() {
   if (setuid_sandbox_client_->IsSuidSandboxChild()) {
     // We expect to have the following FDs open:
     //  1-3) stdin, stdout, stderr.
@@ skipping 63 matching lines @@
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
     if (can_be_no_sandbox)
       LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg;
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
 }
 
 }  // namespace nacl