Allow using the namespace sandbox in zygote host.

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/posix/eintr_wrapper.h"
 #include "build/build_config.h"
 #include "components/nacl/common/nacl_switches.h"
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
+#include "sandbox/linux/services/credentials.h"
+#include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/services/proc_util.h"
 #include "sandbox/linux/services/thread_helpers.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 
 namespace nacl {
 
 namespace {
 
 // This is a poor man's check on whether we are sandboxed.
 bool IsSandboxed() {
@@ skipping 50 matching lines @@
     setuid_sandbox_client_->CloseDummyFile();
 
     // Make sure that no directory file descriptor is open, as it would bypass
     // the setuid sandbox model.
     CHECK(!HasOpenDirectory());
 
     // Get sandboxed.
     CHECK(setuid_sandbox_client_->ChrootMe());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    CHECK(sandbox::Credentials::MoveToNewUserNS());
+    CHECK(sandbox::Credentials::DropFileSystemAccess());
+    CHECK(sandbox::Credentials::DropAllCapabilities());
+    CHECK(IsSandboxed());
+    layer_one_enabled_ = true;
   }
 }
 
 void NaClSandbox::CheckForExpectedNumberOfOpenFds() {
+  // We expect to have the following FDs open:
+  //  1-3) stdin, stdout, stderr.
+  //  4) The /dev/urandom FD used by base::GetUrandomFD().
+  //  5) A dummy pipe FD used to overwrite kSandboxIPCChannel.
+  //  6) The socket for the Chrome IPC channel that's connected to the
+  //     browser process, kPrimaryIPCChannel.
+  // We also have an fd for /proc (proc_fd_), but CountOpenFds excludes this.
+  //
+  // This sanity check ensures that dynamically loaded libraries don't
+  // leave any FDs open before we enable the sandbox.
+  const int kExpectedNumFds = 6;
   if (setuid_sandbox_client_->IsSuidSandboxChild()) {
-    // We expect to have the following FDs open:
-    //  1-3) stdin, stdout, stderr.
-    //  4) The /dev/urandom FD used by base::GetUrandomFD().
-    //  5) A dummy pipe FD used to overwrite kSandboxIPCChannel.
-    //  6) The socket created by the SUID sandbox helper, used by ChrootMe().
-    //     After ChrootMe(), this is no longer connected to anything.
-    //     (Only present when running under the SUID sandbox.)
-    //  7) The socket for the Chrome IPC channel that's connected to the
-    //     browser process, kPrimaryIPCChannel.
-    //
-    // This sanity check ensures that dynamically loaded libraries don't
-    // leave any FDs open before we enable the sandbox.
-    CHECK_EQ(7, sandbox::ProcUtil::CountOpenFds(proc_fd_.get()));
+    // When using the setuid sandbox, there is one additional socket used for
+    // ChrootMe(). After ChrootMe(), it is no longer connected to anything.
+    CHECK_EQ(kExpectedNumFds + 1,
+             sandbox::ProcUtil::CountOpenFds(proc_fd_.get()));
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    CHECK_EQ(kExpectedNumFds, sandbox::ProcUtil::CountOpenFds(proc_fd_.get()));
   }
 }
 
 void NaClSandbox::InitializeLayerTwoSandbox(bool uses_nonsfi_mode) {
   // seccomp-bpf only applies to the current thread, so it's critical to only
   // have a single thread running here.
   DCHECK(!layer_one_sealed_);
   CHECK(IsSingleThreaded());
   CheckForExpectedNumberOfOpenFds();
 
@@ skipping 42 matching lines @@
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
     if (can_be_no_sandbox)
       LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg;
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
 }
 
 }  // namespace nacl