Move a couple of utility functions to a new namespace_utils class.

sandbox/linux/services/namespace_utils_unittest.cc

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/linux/services/namespace_utils.h"
+
+#include <errno.h>
+#include <sched.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "base/posix/eintr_wrapper.h"
+#include "base/process/launch.h"
+#include "sandbox/linux/tests/unit_tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace sandbox {
+
+namespace {
+
+SANDBOX_TEST(NamespaceUtils, SupportsUnprivilegedNamespace) {
+  bool supports_user_ns =
+      NamespaceUtils::SupportsUnprivilegedNamespace(CLONE_NEWUSER);
+  errno = 0;
+  pid_t pid = base::ForkWithFlags(CLONE_NEWUSER, nullptr, nullptr);
+  if (pid == 0) {
+    _exit(0);
+  }
+
+  bool fork_succeeded = pid > 0;
+  if (fork_succeeded) {
+    int status;
+    EXPECT_EQ(pid, HANDLE_EINTR(waitpid(pid, &status, 0)));
+    EXPECT_EQ(0, status);
+  } else {
+    EXPECT_EQ(EINTR, errno);
+  }
+
+  EXPECT_EQ(supports_user_ns, fork_succeeded);

[jln (very slow on Chromium), 2015/01/23 02:48:23]

This will break from inside a chroot. fork_succeeds implies supports_user_ns
though.

[rickyz (no longer on Chrome), 2015/01/23 23:59:37]

Done.

+}
+
+SANDBOX_TEST(NamespaceUtils, WriteToIdMapFile) {
+  if (!NamespaceUtils::SupportsUnprivilegedNamespace(CLONE_NEWUSER)) {
+    return;
+  }
+
+  pid_t pid = base::ForkWithFlags(CLONE_NEWUSER, nullptr, nullptr);
+  ASSERT_NE(-1, pid);

[jln (very slow on Chromium), 2015/01/23 02:48:23]

Same remark, this will fail inside a chroot().

[rickyz (no longer on Chrome), 2015/01/23 23:59:37]

Done.

+
+  uid_t uid = getuid();
+  gid_t gid = getgid();
+  if (pid == 0) {
+    EXPECT_NE(uid, getuid());
+    NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid);
+    EXPECT_EQ(uid, getuid());
+
+    EXPECT_NE(gid, getgid());
+    NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid);
+    EXPECT_EQ(gid, getgid());
+
+    _exit(0);
+  }
+
+  int status;
+  EXPECT_EQ(pid, HANDLE_EINTR(waitpid(pid, &status, 0)));
+  EXPECT_EQ(0, status);
+}
+
+}  // namespace.
+
+}  // namespace sandbox.