daisydog: add cgroup namespace to minijail0 sandboxes
Upstream Linux added cgroup namespace support in 4.6, and Chrome OS
backported support to many more. Now that we've dropped some older
kernels, we can unconditionally utilize this feature in Chrome OS.
I found these files by searching for files with both "minijail0" and
"--uts" in their text, as an easy grep'able starter.
BUG=chromium:1204350
TEST=CQ
Change-Id: I3fbd56859c1fbc0262dc22fc4e6291e968e09d6d
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/daisydog/+/3002053
Reviewed-by: Grant Grundler <grundler@chromium.org>
Commit-Queue: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
diff --git a/daisydog.conf b/daisydog.conf
index 660f5b7..f40615e 100644
--- a/daisydog.conf
+++ b/daisydog.conf
@@ -15,7 +15,7 @@
oom score never
env minijail_common_args=" \
- -I -p -e -l -r -v -n --uts \
+ -I -N -p -e -l -r -v -n --uts \
--profile minimalistic-mountns -b /dev/watchdog \
-u watchdog -g watchdog \
-- /usr/sbin/daisydog"
