Add SetCapabilities for setting capabilities to an exact set.

sandbox/linux/services/credentials.h

Index: sandbox/linux/services/credentials.h
diff --git a/sandbox/linux/services/credentials.h b/sandbox/linux/services/credentials.h
index 91435611851f81a0d2136feb3975180d5158874a..d6f41d431fca324407e80b3e6592c4b6e7a19aff 100644
--- a/sandbox/linux/services/credentials.h
+++ b/sandbox/linux/services/credentials.h
@@ -12,6 +12,7 @@
 #endif  // defined(OS_ANDROID).
 
 #include <string>
+#include <vector>
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
@@ -26,7 +27,7 @@ namespace sandbox {
 class SANDBOX_EXPORT Credentials {
  public:
   // Drop all capabilities in the effective, inheritable and permitted sets for
-  // the current process. For security reasons, since capabilities are
+  // the current thread. For security reasons, since capabilities are
   // per-thread, the caller is responsible for ensuring it is single-threaded
   // when calling this API.
   // |proc_fd| must be a file descriptor to /proc/ and remains owned by
@@ -34,14 +35,18 @@ class SANDBOX_EXPORT Credentials {
   static bool DropAllCapabilities(int proc_fd) WARN_UNUSED_RESULT;
   // A similar API which assumes that it can open /proc/self/ by itself.
   static bool DropAllCapabilities() WARN_UNUSED_RESULT;
+  // Sets the effective and permitted capability sets for the current thread to
+  // the list of capabiltiies in |caps|. All other capability flags are cleared.
+  static bool SetCapabilities(int proc_fd, const std::vector<int>& caps)

[jln (very slow on Chromium), 2015/03/12 20:46:30]

Would it be worth taking an enum class instead of ints for capabilities?

Since we only support two of them, that should be easy. Then, users of this
class don't need to include a clunky header to get CAP_SYS_CHROOT value.

[rickyz (no longer on Chrome), 2015/03/12 23:36:01]

Done.

+      WARN_UNUSED_RESULT;
+
+  // Returns true if the current thread has either the CAP_EFFECTIVE or
+  // CAP_PERMITTED flag set for the given capability.

[jln (very slow on Chromium), 2015/03/12 19:24:15]

The implementation also considers CAP_INHERITABLE. That's fine with me, but we
need to match in the documentation.

[rickyz (no longer on Chrome), 2015/03/12 23:36:01]

Oops, I updated the documentation. It bothers me a bit that this is inconsistent
with SetCapabilities, but this seems like the more conservative behavior.

+  static bool HasCapability(int cap);
 
   // Return true iff there is any capability in any of the capabilities sets
-  // of the current process.
+  // of the current thread.
   static bool HasAnyCapability();
-  // Returns the capabilities of the current process in textual form, as
-  // documented in libcap2's cap_to_text(3). This is mostly useful for
-  // debugging and tests.
-  static scoped_ptr<std::string> GetCurrentCapString();
 
   // Returns whether the kernel supports CLONE_NEWUSER and whether it would be
   // possible to immediately move to a new user namespace. There is no point