GitLab

Debian 8 restricts use of CLONE_NEWUSER to only processes with
CAP_SYS_ADMIN. (https://github.com/semplice/linux/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch)
Chrome was previously checking if the kernel supported CLONE_NEWUSER
by running clone(CLONE_NEWUSER, ...) with the same capabilities chrome
was launched with.  This leads to 2 scenarios:

1. If Chrome was run as root:
   The check for CLONE_NEWUSER will succeed.  Chrome will then set up
   the namespace sandbox by clone()'ing and dropping CAP_SYS_ADMIN.
   Subsequent clone()'s with CLONE_NEWUSER will then fail.

2. If Chrome was run as a normal user:
   The check for CLONE_NEWUSER will fail.  Chrome will fallback to
   using the setuid sandbox.

The solution is to simply drop CAP_SYS_ADMIN before the check.

In addition, this CL disallows running Chromium as root unless launched
with --no-sandbox.

BUG=638180

Review-Url: https://codereview.chromium.org/2578483002
Cr-Commit-Position: refs/heads/master@{#443062}