Start all children in their own PID namespace.

sandbox/linux/services/credentials_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <sys/capability.h>
@@ skipping 159 matching lines @@
   CHECK(!Credentials::MoveToNewUserNS());
 }
 
 SANDBOX_TEST(Credentials, SetCapabilities) {
   // Probably missing kernel support.
   if (!Credentials::MoveToNewUserNS())
     return;
 
   base::ScopedFD proc_fd(ProcUtil::OpenProc());
 
-  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysAdmin));
-  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysChroot));
+  CHECK(Credentials::HasCapability(Credentials::Capability::SYS_ADMIN));
+  CHECK(Credentials::HasCapability(Credentials::Capability::SYS_CHROOT));
 
-  const std::vector<LinuxCapability> caps = {LinuxCapability::kCapSysChroot};
+  std::vector<Credentials::Capability> caps;
+  caps.push_back(Credentials::Capability::SYS_CHROOT);
   CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));
 
-  CHECK(!Credentials::HasCapability(LinuxCapability::kCapSysAdmin));
-  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysChroot));
+  CHECK(!Credentials::HasCapability(Credentials::Capability::SYS_ADMIN));
+  CHECK(Credentials::HasCapability(Credentials::Capability::SYS_CHROOT));
 
-  const std::vector<LinuxCapability> no_caps;
+  const std::vector<Credentials::Capability> no_caps;
   CHECK(Credentials::SetCapabilities(proc_fd.get(), no_caps));
   CHECK(!Credentials::HasAnyCapability());
 }
 
 SANDBOX_TEST(Credentials, SetCapabilitiesAndChroot) {
   // Probably missing kernel support.
   if (!Credentials::MoveToNewUserNS())
     return;
 
   base::ScopedFD proc_fd(ProcUtil::OpenProc());
 
-  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysChroot));
+  CHECK(Credentials::HasCapability(Credentials::Capability::SYS_CHROOT));
   PCHECK(chroot("/") == 0);
 
-  const std::vector<LinuxCapability> caps = {LinuxCapability::kCapSysChroot};
+  std::vector<Credentials::Capability> caps;
+  caps.push_back(Credentials::Capability::SYS_CHROOT);
   CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));
   PCHECK(chroot("/") == 0);
 
   CHECK(Credentials::DropAllCapabilities());
   PCHECK(chroot("/") == -1 && errno == EPERM);
 }
 
 SANDBOX_TEST(Credentials, SetCapabilitiesMatchesLibCap2) {
   // Probably missing kernel support.
   if (!Credentials::MoveToNewUserNS())
     return;
 
   base::ScopedFD proc_fd(ProcUtil::OpenProc());
 
-  const std::vector<LinuxCapability> caps = {LinuxCapability::kCapSysChroot};
+  std::vector<Credentials::Capability> caps;
+  caps.push_back(Credentials::Capability::SYS_CHROOT);
   CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));
 
   ScopedCap actual_cap(cap_get_proc());
   PCHECK(actual_cap != nullptr);
 
   ScopedCap expected_cap(cap_init());
   PCHECK(expected_cap != nullptr);
 
   const cap_value_t allowed_cap = CAP_SYS_CHROOT;
   for (const cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) {
     PCHECK(cap_set_flag(expected_cap.get(), flag, 1, &allowed_cap, CAP_SET) ==
            0);
   }
 
   CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get()));
 }
 
 }  // namespace.
 
 }  // namespace sandbox.