Allow using the namespace sandbox in zygote host.

content/zygote/zygote_main_linux.cc

Index: content/zygote/zygote_main_linux.cc
diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc
index 8f89580d42f6ed7a97b86e0e8651acf0905675a5..b7c7a0d5b97bb5f51f8bff9edc2246c90ab91078 100644
--- a/content/zygote/zygote_main_linux.cc
+++ b/content/zygote/zygote_main_linux.cc
@@ -39,8 +39,10 @@
 #include "content/public/common/zygote_fork_delegate_linux.h"
 #include "content/zygote/zygote_linux.h"
 #include "crypto/nss_util.h"
+#include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/init_process_reaper.h"
 #include "sandbox/linux/services/libc_urandom_override.h"
+#include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 #include "third_party/icu/source/i18n/unicode/timezone.h"
 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
@@ -470,6 +472,23 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox,
   return true;
 }
 
+static void EnterNamespaceSandbox(base::Closure* post_fork_parent_callback) {
+  pid_t pid = getpid();
+  if (sandbox::NamespaceSandbox::InNewPidNamespace()) {
+    CHECK_EQ(1, pid);
+  }
+
+  CHECK(sandbox::Credentials::MoveToNewUserNS());
+  CHECK(sandbox::Credentials::DropFileSystemAccess());
+  // We do not drop capabilities because we will use CAP_SYS_ADMIN to place
+  // each child process in its own PID namespace later on (this is not yet
+  // implemented).
+
+  if (pid == 1) {
+    CHECK(CreateInitProcessReaper(post_fork_parent_callback));
+  }
+}
+
 #if defined(ADDRESS_SANITIZER)
 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024;
 
@@ -546,6 +565,8 @@ static void EnterLayerOneSandbox(LinuxSandbox* linux_sandbox,
   if (is_suid_sandbox_child) {
     CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback))
         << "Failed to enter setuid sandbox";
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    EnterNamespaceSandbox(post_fork_parent_callback);
   }
 }