Minor refactoring of setuid_sandbox_client.

sandbox/linux/suid/client/setuid_sandbox_client.cc

Index: sandbox/linux/suid/client/setuid_sandbox_client.cc
diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
index f0b5cef1e0068ef9c0ddc1deccf46786ade54a4a..9eb538ae37719e088d07e3735b1681c2767c8ec0 100644
--- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
+++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
@@ -18,7 +18,6 @@
 #include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
-#include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/path_service.h"
 #include "base/posix/eintr_wrapper.h"
@@ -32,7 +31,7 @@
 namespace {
 
 bool IsFileSystemAccessDenied() {
-  base::ScopedFD self_exe(HANDLE_EINTR(open(base::kProcSelfExe, O_RDONLY)));
+  base::ScopedFD self_exe(HANDLE_EINTR(open("/", O_RDONLY)));

[jln (very slow on Chromium), 2015/02/05 00:12:52]

This seems like it could easily regress. What was the reason for this?

It's kind of a "small trick" that the setuid sandbox currently doesn't even let
access /. But we would consider the process sandboxed even if it was in an empty
chroot instead.

[mdempsky, 2015/02/05 01:41:19]

Removing base::kProcSelfExe was so this function could compile without dragging
in base/process/process_metrics_linux.cc and its transitive dependencies.

Changing from "/proc/self/exe" to "/" was my suggestion, because I think it's a
stronger test that we've actually dropped filesystem access.  Agreed that we
might in the future want to relax this and allow *some* filesystem access, but I
think it'll be easy enough to tweak this test again if/when necessary.

   return !self_exe.is_valid();
 }
 
@@ -208,11 +207,6 @@ bool SetuidSandboxClient::ChrootMe() {
   return true;
 }
 
-bool SetuidSandboxClient::CreateInitProcessReaper(
-    base::Closure* post_fork_parent_callback) {
-  return sandbox::CreateInitProcessReaper(post_fork_parent_callback);
-}
-
 bool SetuidSandboxClient::IsSuidSandboxUpToDate() const {
   return GetHelperApi(env_) == kSUIDSandboxApiNumber;
 }