Enable one PID namespace per process for NaCl processes.

sandbox/linux/services/credentials.h

Index: sandbox/linux/services/credentials.h
diff --git a/sandbox/linux/services/credentials.h b/sandbox/linux/services/credentials.h
index 0001dc732802fe008719025554d4bdaac4f776fb..095d636d42712c2132fd7aa3d9e995836eb646fa 100644
--- a/sandbox/linux/services/credentials.h
+++ b/sandbox/linux/services/credentials.h
@@ -95,6 +95,9 @@ class SANDBOX_EXPORT Credentials {
   //   - DropAllCapabilities() must be called to prevent escapes.
   static bool DropFileSystemAccess(int proc_fd) WARN_UNUSED_RESULT;
 
+  // Forks and drops capabilities in the child.
+  static pid_t ForkAndDropCapabilitiesInChild();
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(Credentials);
 };