Add namespace sandbox class.

sandbox/linux/services/namespace_utils_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/namespace_utils.h"
 
 #include <errno.h>
 #include <sched.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ skipping 26 matching lines @@
     return;
   }
 
   const uid_t uid = getuid();
   const gid_t gid = getgid();
 
   const pid_t pid =
       base::ForkWithFlags(CLONE_NEWUSER | SIGCHLD, nullptr, nullptr);
   ASSERT_NE(-1, pid);
   if (pid == 0) {
     RAW_CHECK(getuid() != uid);

[jln (very slow on Chromium), 2015/02/02 18:54:45]

These can be CHECKs (just need to _exit and not exit()).

Using RAW_CHECK is a little scary here: it looks like a bug given that
WriteToIdMapFile is not async signal safe.

[rickyz (no longer on Chrome), 2015/02/02 21:35:31]

Looks like WriteToIdMapFile not being async-signal-safe was a bug - that's fixed
now.

[jln (very slow on Chromium), 2015/02/03 01:14:30]

I don't think this code here needs to be async safe though.

-    NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid);
+    RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid));
     RAW_CHECK(getuid() == uid);
 
     RAW_CHECK(getgid() != gid);
-    NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid);
+    RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid));
     RAW_CHECK(getgid() == gid);
 
     _exit(0);
   }
 
   int status = 42;
   SANDBOX_ASSERT_EQ(pid, HANDLE_EINTR(waitpid(pid, &status, 0)));
   SANDBOX_ASSERT_EQ(0, status);
 }
 
 }  // namespace.
 
 }  // namespace sandbox.