Update from https://crrev.com/316786

sandbox/linux/services/namespace_sandbox.cc

Index: sandbox/linux/services/namespace_sandbox.cc
diff --git a/sandbox/linux/services/namespace_sandbox.cc b/sandbox/linux/services/namespace_sandbox.cc
index 559b93c7e6e19621fdf8e363fddb2ab69f1f42bd..0f371ebfd3198e77d697e25ece5cfec4e141d164 100644
--- a/sandbox/linux/services/namespace_sandbox.cc
+++ b/sandbox/linux/services/namespace_sandbox.cc
@@ -11,6 +11,7 @@
 
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "base/command_line.h"
 #include "base/environment.h"
@@ -27,18 +28,26 @@ namespace {
 
 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
  public:
-  WriteUidGidMapDelegate() : uid_(getuid()), gid_(getgid()) {}
+  WriteUidGidMapDelegate()
+      : uid_(getuid()),
+        gid_(getgid()),
+        supports_deny_setgroups_(
+            NamespaceUtils::KernelSupportsDenySetgroups()) {}
 
   ~WriteUidGidMapDelegate() override {}
 
   void RunAsyncSafe() override {
+    if (supports_deny_setgroups_) {
+      RAW_CHECK(NamespaceUtils::DenySetgroups());
+    }
     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
   }
 
  private:
-  uid_t uid_;
-  gid_t gid_;
+  const uid_t uid_;
+  const gid_t gid_;
+  const bool supports_deny_setgroups_;
   DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
 };
 
@@ -59,6 +68,13 @@ const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
 base::Process NamespaceSandbox::LaunchProcess(
     const base::CommandLine& cmdline,
     const base::LaunchOptions& options) {
+  return LaunchProcess(cmdline.argv(), options);
+}
+
+// static
+base::Process NamespaceSandbox::LaunchProcess(
+    const std::vector<std::string>& argv,
+    const base::LaunchOptions& options) {
   int clone_flags = 0;
   int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
   for (const int ns_type : ns_types) {
@@ -91,7 +107,7 @@ base::Process NamespaceSandbox::LaunchProcess(
     SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
   }
 
-  return base::LaunchProcess(cmdline, launch_options);
+  return base::LaunchProcess(argv, launch_options);
 }
 
 // static