Allow using the namespace sandbox in zygote host.

content/browser/zygote_host/zygote_host_impl_linux.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_ZYGOTE_HOST_ZYGOTE_HOST_IMPL_LINUX_H_
 #define CONTENT_BROWSER_ZYGOTE_HOST_ZYGOTE_HOST_IMPL_LINUX_H_
 
 #include <set>
 #include <string>
 #include <vector>
@@ skipping 64 matching lines @@
   // Should be called every time a Zygote child died.
   void ZygoteChildDied(pid_t process);
 
   // Sends |data| to the zygote via |control_fd_|.  If |fds| is non-NULL, the
   // included file descriptors will also be passed.  The caller is responsible
   // for acquiring |control_lock_|.
   bool SendMessage(const Pickle& data, const std::vector<int>* fds);
 
   ssize_t ReadReply(void* buf, size_t buflen);
 
+  // Whether we should use the namespace sandbox instead of the setuid sandbox.
+  // Currently, the namespace sandbox is enabled when sandboxing is not
+  // disabled, the enable-namespace-sandbox switch is set, user namespaces are
+  // supported, and seccomp BPF is supported.
+  bool ShouldUseNamespaceSandbox();
+
   int control_fd_;  // the socket to the zygote
   // A lock protecting all communication with the zygote. This lock must be
   // acquired before sending a command and released after the result has been
   // received.
   base::Lock control_lock_;
   pid_t pid_;
   bool init_;
   bool using_suid_sandbox_;
   std::string sandbox_binary_;
   bool have_read_sandbox_status_word_;
   int sandbox_status_;
   // A lock protecting list_of_running_zygote_children_ and
   // should_teardown_after_last_child_exits_.
   base::Lock child_tracking_lock_;
   std::set<pid_t> list_of_running_zygote_children_;
   bool should_teardown_after_last_child_exits_;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_ZYGOTE_HOST_ZYGOTE_HOST_IMPL_LINUX_H_