Use NoNewPrivs for daisydog.
Doesn't look like daisydog is launching anything that requires to
elevate privilege.
BUG=chromium:730623
TEST=security_SandboxedServices.
Change-Id: Ia6ea273c543c2e4a9bd9d7dd0e49142d2e08640a
Reviewed-on: https://chromium-review.googlesource.com/527817
Commit-Ready: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
diff --git a/daisydog.conf b/daisydog.conf
index 70d712c..0d4dfc8 100644
--- a/daisydog.conf
+++ b/daisydog.conf
@@ -10,7 +10,7 @@
respawn
expect fork
-env minijail_common_args="-I -p -e -l -r -v \
+env minijail_common_args="-I -p -e -l -r -v -n \
-u watchdog -g watchdog \
-- /usr/sbin/daisydog"
