Start all children in their own PID namespace.

sandbox/linux/services/credentials.h

Index: sandbox/linux/services/credentials.h
diff --git a/sandbox/linux/services/credentials.h b/sandbox/linux/services/credentials.h
index 6b37d4904eca5c53f5f3f18d50fa47aee6936792..117681c6f54c034940049b4b7aaec277e94ea0a3 100644
--- a/sandbox/linux/services/credentials.h
+++ b/sandbox/linux/services/credentials.h
@@ -5,6 +5,8 @@
 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_
 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_
 
+#include <sys/capability.h>

[jln (very slow on Chromium), 2015/02/25 21:32:49]

:(

[rickyz (no longer on Chrome), 2015/03/21 01:35:32]

Superseded by https://codereview.chromium.org/997463002/ :-)

+
 #include "build/build_config.h"
 // Link errors are tedious to track, raise a compile-time error instead.
 #if defined(OS_ANDROID)
@@ -12,6 +14,7 @@
 #endif  // defined(OS_ANDROID).
 
 #include <string>
+#include <vector>
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
@@ -26,7 +29,7 @@ namespace sandbox {
 class SANDBOX_EXPORT Credentials {
  public:
   // Drop all capabilities in the effective, inheritable and permitted sets for
-  // the current process. For security reasons, since capabilities are
+  // the current thread. For security reasons, since capabilities are
   // per-thread, the caller is responsible for ensuring it is single-threaded
   // when calling this API.
   // |proc_fd| must be a file descriptor to /proc/ and remains owned by
@@ -34,11 +37,15 @@ class SANDBOX_EXPORT Credentials {
   static bool DropAllCapabilities(int proc_fd) WARN_UNUSED_RESULT;
   // A similar API which assumes that it can open /proc/self/ by itself.
   static bool DropAllCapabilities() WARN_UNUSED_RESULT;
+  // Sets the effective and permitted capability sets for the current thread to
+  // the list of capabiltiies in |caps|. All other capability flags are cleared.
+  static bool SetCapabilities(int proc_fd,

[jln (very slow on Chromium), 2015/02/25 21:32:49]

Not great to expose that. Probably ok for now, but we may want to go to the
trouble of defining our own enum class of capability and wrapping the whole low
level API.

It will make it easier to migrate out of libcap. It looks like we'll need it
anymore.

[rickyz (no longer on Chrome), 2015/03/21 01:35:32]

Superseded by https://codereview.chromium.org/997463002/ :-)

+                              const std::vector<cap_value_t>& caps);
 
   // Return true iff there is any capability in any of the capabilities sets
-  // of the current process.
+  // of the current thread.
   static bool HasAnyCapability();
-  // Returns the capabilities of the current process in textual form, as
+  // Returns the capabilities of the current thread in textual form, as
   // documented in libcap2's cap_to_text(3). This is mostly useful for
   // debugging and tests.
   static scoped_ptr<std::string> GetCurrentCapString();