Add extra check that the namespace sandbox is engaged.

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/zygote/zygote_main.h"
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
@@ skipping 628 matching lines @@
   // the destruction of the PID namespace could kill the helper before it
   // completes its I/O tasks. |sancov_helper_pid| will exit once the last
   // renderer holding the write end of |sancov_socket_fds| closes it.
   extra_children.push_back(sancov_helper_pid);
   // Sanitizer code in the renderers will inherit the write end of the socket
   // from the zygote. We must keep it open until the very end of the zygote's
   // lifetime, even though we don't explicitly use it.
   extra_fds.push_back(sancov_socket_fds[1]);
 #endif
 
-  int sandbox_flags = linux_sandbox->GetStatus();
-  bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
+  const int sandbox_flags = linux_sandbox->GetStatus();
+
+  const bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
   CHECK_EQ(using_setuid_sandbox, setuid_sandbox_engaged);
 
+  const bool namespace_sandbox_engaged = sandbox_flags & kSandboxLinuxUserNS;
+  CHECK_EQ(using_namespace_sandbox, namespace_sandbox_engaged);
+
   Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
                 extra_fds);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content