Namespace sandbox: add important security checks

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
index 8d4a2259e1e2e641f334c5c152c869273efcb685..44cb4f57b8d2153ab4157bbe7a4f861527588a8a 100644
--- a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
@@ -115,7 +115,10 @@ void NaClSandbox::InitializeLayerOneSandbox() {
     layer_one_enabled_ = true;
   } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
     CHECK(sandbox::Credentials::MoveToNewUserNS());
+    // This relies on SealLayerOneSandbox() to be called later.
+    CHECK(!HasOpenDirectory());
     CHECK(sandbox::Credentials::DropFileSystemAccess());
+    CHECK(IsSingleThreaded());
     CHECK(sandbox::Credentials::DropAllCapabilities());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;