Enable one PID namespace per process for NaCl processes.

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
@@ skipping 122 matching lines @@
     CHECK(!HasOpenDirectory());
 
     // Get sandboxed.
     CHECK(setuid_sandbox_client_->ChrootMe());
     CHECK(MaybeSetProcessNonDumpable());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
     CHECK(sandbox::Credentials::MoveToNewUserNS());
     // This relies on SealLayerOneSandbox() to be called later since this
     // class is keeping a file descriptor to /proc/.

[jln (very slow on Chromium), 2015/05/28 09:02:33]

Doesn't this comment apply to both the setuid sandbox case and the userNS case?

[rickyz (no longer on Chrome), 2015/05/29 23:16:39]

Yeah, removed this comment, it made more sense in the place I copy/pasted it
from.

     CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_.get()));
-    CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd_.get()));
+
+    // We do not drop CAP_SYS_ADMIN because we need it to place each child
+    // process in its own PID namespace later on.

[jln (very slow on Chromium), 2015/05/28 09:02:33]

This is unfortunate. This should be dropped as part of a mandatory mechanism
like SealLayerOneSandbox. Except that the layer 2 sandbox will prevent us from
doing it. Perhaps do it as part of engaging the layer 2 sandbox? (And also as
part of SealLayerOneSandbox when layer 2 is not engaged).

We need to be careful to make all of this clear and not look like spaghetti.

+    std::vector<sandbox::Credentials::Capability> caps;
+    caps.push_back(sandbox::Credentials::Capability::SYS_ADMIN);
+    CHECK(sandbox::Credentials::SetCapabilities(proc_fd_.get(), caps));
+
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   }
 }
 
 void NaClSandbox::CheckForExpectedNumberOfOpenFds() {
   // We expect to have the following FDs open:
   //  1-3) stdin, stdout, stderr.
   //  4) The /dev/urandom FD used by base::GetUrandomFD().
   //  5) A dummy pipe FD used to overwrite kSandboxIPCChannel.
@@ skipping 79 matching lines @@
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
     if (can_be_no_sandbox)
       LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg;
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
 }
 
 }  // namespace nacl