Enable one PID namespace per process for NaCl processes.

sandbox/linux/services/namespace_sandbox_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/namespace_sandbox.h"
 
 #include <signal.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
@@ skipping 102 matching lines @@
   CHECK(process.WaitForExit(&exit_code));
   CHECK_EQ(0, exit_code);
   return 0;
 }
 
 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) {
   TestProc("NestedNamespaceSandbox");
 }
 
 const int kNormalExitCode = 0;
-const int kSignalTerminationExitCode = 255;
 
 // Ensure that CHECK(false) is distinguishable from _exit(kNormalExitCode).
 // Allowing noise since CHECK(false) will write a stack trace to stderr.
 SANDBOX_TEST_ALLOW_NOISE(ForkInNewPidNamespace, CheckDoesNotReturnZero) {
   if (!Credentials::CanCreateProcessInNewUserNS()) {
     return;
   }
 
   CHECK(sandbox::Credentials::MoveToNewUserNS());
   const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(
@@ skipping 41 matching lines @@
 
   CHECK(sandbox::Credentials::MoveToNewUserNS());
   const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(
       /*drop_capabilities_in_child=*/true);
   CHECK_GE(pid, 0);
 
   if (pid == 0) {
     CHECK_EQ(1, getpid());
     CHECK(!Credentials::HasAnyCapability());
     CHECK(NamespaceSandbox::InstallTerminationSignalHandler(
-        SIGTERM, kSignalTerminationExitCode));
+        SIGTERM, NamespaceSandbox::SignalExitCode(SIGTERM)));
     while (true) {
       raise(SIGTERM);
     }
   }
 
   int status;
   PCHECK(waitpid(pid, &status, 0) == pid);
   CHECK(WIFEXITED(status));
-  CHECK_EQ(kSignalTerminationExitCode, WEXITSTATUS(status));
+  CHECK_EQ(NamespaceSandbox::SignalExitCode(SIGTERM), WEXITSTATUS(status));
 }
 
 volatile sig_atomic_t signal_handler_called;
 void ExitSuccessfully(int sig) {
   signal_handler_called = 1;
 }
 
 SANDBOX_TEST(InstallTerminationSignalHandler, DoesNotOverrideExistingHandlers) {
   struct sigaction action = {};
   action.sa_handler = &ExitSuccessfully;
   PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0);
 
   NamespaceSandbox::InstallDefaultTerminationSignalHandlers();
   CHECK(!NamespaceSandbox::InstallTerminationSignalHandler(
-            SIGUSR1, kSignalTerminationExitCode));
+            SIGUSR1, NamespaceSandbox::SignalExitCode(SIGUSR1)));
 
   raise(SIGUSR1);
   CHECK_EQ(1, signal_handler_called);
 }
 
 }  // namespace
 
 }  // namespace sandbox