minijail: add user namespace support
Since most of the operations can be done if we have |euid = 0| in the
new user namespace, we enter a new user namespace and become root
immediately after fork()/clone().
It is incompatible with -b and <writable> set to 0, since we are not
able to remount bind mounts as readonly in a user namespace.
BUG=chromium:517387
TEST=security_Minijail0 pass
TEST=`minijail0 -m "0 1000 1" -M "0 1000 1" -- /usr/bin/touch t`
TEST=file `t` has owner:group root:root in minijail
TEST=and chronos:chronos outside minijail
Change-Id: I48f888097be5211715c5a839eca6f8e43b9903dd
Reviewed-on: https://chromium-review.googlesource.com/291200
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Yu-hsi Chiang <yuhsi@google.com>
Commit-Queue: Nicolas Boichat <drinkcat@chromium.org>
Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>
3 files changed
