Add NEWNS and NEWNET to the SUID sandbox.
Add NEWNS and NEWNET to the SUID sandbox.

This patch attempts to fork off the sandboxed process with the
additional NEWNS and NEWNET flags. If these flags aren't supported at
runtime then the code will degrade to the current behaviour.

NEWNS starts children in a new mount namespace so that they cannot
affect the parent's mounts. (This is a little bit useless every little
helps.)

NEWNET starts children in a new network space, initially with no
network devices and this stops sandboxed processes from talking to the
network. Additionally, children exist in their own namespaces for UNIX
domain sockets and the abstract namespace.

http://codereview.chromium.org/2108020/show

git-svn-id: dd90618784b6a4b323ea0c23a071cb1c9e6f2ac7@48040 4ff67af0-8c30-449e-8e8b-ad334ec8d88c

wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser,wistoch/meego-app-browser