Allow using the namespace sandbox in zygote host.

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
index 5c4fa4224f7c2d0efbb4d203911da1286cb40fbb..d58df57c93af7f2015c6d37f861b67dbaf8de7dd 100644
--- a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
@@ -6,6 +6,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
@@ -22,7 +23,10 @@
 #include "components/nacl/common/nacl_switches.h"
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
+#include "content/public/common/content_switches.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
+#include "sandbox/linux/services/credentials.h"
+#include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/services/proc_util.h"
 #include "sandbox/linux/services/thread_helpers.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
@@ -50,6 +54,21 @@ base::ScopedFD GetProcSelfTask(int proc_fd) {
   return proc_self_task.Pass();
 }
 
+bool MaybeSetProcessNonDumpable() {

[jln (very slow on Chromium), 2015/02/06 00:37:29]

Good catch. Let's split it into its own CL if you don't mind.

[rickyz (no longer on Chrome), 2015/02/06 01:53:18]

Split this out into https://codereview.chromium.org/901683003/.

+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  if (command_line.HasSwitch(switches::kAllowSandboxDebugging)) {
+    return true;
+  }
+
+  if (prctl(PR_SET_DUMPABLE, 0) != 0) {
+    PLOG(ERROR) << "Failed to set non-dumpable flag";
+    return false;
+  }
+
+  return prctl(PR_GET_DUMPABLE) == 0;
+}
+
 }  // namespace
 
 NaClSandbox::NaClSandbox()
@@ -91,6 +110,17 @@ void NaClSandbox::InitializeLayerOneSandbox() {
 
     // Get sandboxed.
     CHECK(setuid_sandbox_client_->ChrootMe());
+    CHECK(MaybeSetProcessNonDumpable());
+    CHECK(IsSandboxed());
+    layer_one_enabled_ = true;
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    CHECK(sandbox::Credentials::MoveToNewUserNS());
+    CHECK(sandbox::Credentials::DropFileSystemAccess());
+    CHECK(sandbox::Credentials::DropAllCapabilities());
+
+    // This needs to happen after moving to a new user NS, since doing so
+    // involves writing the UID/GID map.
+    CHECK(MaybeSetProcessNonDumpable());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   }
@@ -111,6 +141,9 @@ void NaClSandbox::CheckForExpectedNumberOfOpenFds() {
     // This sanity check ensures that dynamically loaded libraries don't
     // leave any FDs open before we enable the sandbox.
     CHECK_EQ(7, sandbox::ProcUtil::CountOpenFds(proc_fd_.get()));
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    // Same as above, except minus the SUID sandbox helper FD.
+    CHECK_EQ(6, sandbox::ProcUtil::CountOpenFds(proc_fd_.get()));

[jln (very slow on Chromium), 2015/02/06 00:37:29]

Maybe symbolize that count and -1/+1 it?

[rickyz (no longer on Chrome), 2015/02/06 01:53:18]

Done.

   }
 }