Update from https://crrev.com/311076

sandbox/linux/services/credentials.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <signal.h>
 #include <stdio.h>
 #include <sys/capability.h>
@@ skipping 139 matching lines @@
   // namespaces are used. EINVAL for kernels that don't support the feature.
   // Valgrind will ENOSYS unshare().
   PCHECK(error == EPERM || error == EUSERS || error == EINVAL ||
          error == ENOSYS);
 }
 
 }  // namespace.
 
 namespace sandbox {
 
-Credentials::Credentials() {
-}
-
-Credentials::~Credentials() {
-}
-
 bool Credentials::DropAllCapabilities() {
   ScopedCap cap(cap_init());
   CHECK(cap);
   PCHECK(0 == cap_set_proc(cap.get()));
+  CHECK(!HasAnyCapability());
   // We never let this function fail.
   return true;
 }
 
-bool Credentials::HasAnyCapability() const {
+bool Credentials::HasAnyCapability() {
   ScopedCap current_cap(cap_get_proc());
   CHECK(current_cap);
   ScopedCap empty_cap(cap_init());
   CHECK(empty_cap);
   return cap_compare(current_cap.get(), empty_cap.get()) != 0;
 }
 
-scoped_ptr<std::string> Credentials::GetCurrentCapString() const {
+scoped_ptr<std::string> Credentials::GetCurrentCapString() {
   ScopedCap current_cap(cap_get_proc());
   CHECK(current_cap);
   ScopedCapText cap_text(cap_to_text(current_cap.get(), NULL));
   CHECK(cap_text);
   return scoped_ptr<std::string> (new std::string(cap_text.get()));
 }
 
 // static
 bool Credentials::SupportsNewUserNS() {
   // Valgrind will let clone(2) pass-through, but doesn't support unshare(),
@@ skipping 52 matching lines @@
   CHECK(WriteToIdMapFile(kUidMapFile, uid));
   DCHECK(GetRESIds(NULL, NULL));
   return true;
 }
 
 bool Credentials::DropFileSystemAccess() {
   return ChrootToSafeEmptyDir();
 }
 
 }  // namespace sandbox.