Start all children in their own PID namespace.

sandbox/linux/services/namespace_sandbox_unittest.cc

Index: sandbox/linux/services/namespace_sandbox_unittest.cc
diff --git a/sandbox/linux/services/namespace_sandbox_unittest.cc b/sandbox/linux/services/namespace_sandbox_unittest.cc
index 8bb0bff83b7027d86d8b8e08ae82e0ea7ddd8c5a..667d7a45b0ad231fac053ceef15fd2dda3004b6e 100644
--- a/sandbox/linux/services/namespace_sandbox_unittest.cc
+++ b/sandbox/linux/services/namespace_sandbox_unittest.cc
@@ -118,6 +118,55 @@ TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) {
   TestProc("NestedNamespaceSandbox");
 }
 
+const int kNormalExitCode = 0;
+const int kSignalTerminationExitCode = 255;
+
+SANDBOX_TEST(ForkInNewPidNamespace, BasicUsage) {
+  if (!Credentials::CanCreateProcessInNewUserNS()) {
+    return;
+  }
+
+  CHECK(sandbox::Credentials::MoveToNewUserNS());
+  const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(true);
+  CHECK_GE(pid, 0);
+
+  if (pid == 0) {
+    CHECK_EQ(1, getpid());

[jln (very slow on Chromium), 2015/03/25 23:47:50]

I don't like the implicit dependency on kNormalExitCode being different from
what CHECK would exit with.

Maybe add a test for CHECK(false) exiting with something else than
kNormalExitCode?

[rickyz (no longer on Chrome), 2015/03/26 00:09:37]

Sure, I added the test (and found out in the process that the stack trace from
the CHECK failure would cause the test to fail if we hit it)

[jln (very slow on Chromium), 2015/03/26 00:49:47]

Indeed, but that's a SANDBOX_TEST feature FYI :)

+    CHECK(!Credentials::HasAnyCapability());
+    _exit(kNormalExitCode);
+  }
+
+  int status;
+  PCHECK(waitpid(pid, &status, 0) == pid);
+  CHECK(WIFEXITED(status));
+  CHECK_EQ(kNormalExitCode, WEXITSTATUS(status));
+}
+
+SANDBOX_TEST(ForkInNewPidNamespace, ExitWithSignal) {
+  if (!Credentials::CanCreateProcessInNewUserNS()) {
+    return;
+  }
+
+  CHECK(sandbox::Credentials::MoveToNewUserNS());
+  const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(true);

[jln (very slow on Chromium), 2015/03/25 23:47:50]

/* drop_capabilities_in_child */

[rickyz (no longer on Chrome), 2015/03/26 00:09:37]

Done.

+  CHECK_GE(pid, 0);
+
+  if (pid == 0) {
+    CHECK_EQ(1, getpid());
+    CHECK(!Credentials::HasAnyCapability());
+    NamespaceSandbox::InstallTerminationSignalHandler(
+        SIGTERM, kSignalTerminationExitCode);
+    while (true) {
+      raise(SIGTERM);
+    }
+  }
+
+  int status;
+  PCHECK(waitpid(pid, &status, 0) == pid);
+  CHECK(WIFEXITED(status));
+  CHECK_EQ(kSignalTerminationExitCode, WEXITSTATUS(status));
+}
+
 }  // namespace
 
 }  // namespace sandbox