From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jeremy Apthorp <nornagon@nornagon.net>
Date: Mon, 26 Aug 2019 12:02:51 -0700
Subject: allow new privileges in unsandboxed child processes

This allows unsandboxed child process to launch setuid processes on Linux.

diff --git a/content/browser/child_process_launcher_helper_linux.cc b/content/browser/child_process_launcher_helper_linux.cc
index dd5ccfc0bdc2e071999d1bf864dc065dd1311407..cfadd28fca9f80bf57578db78d5472c4f75414e1 100644
--- a/content/browser/child_process_launcher_helper_linux.cc
+++ b/content/browser/child_process_launcher_helper_linux.cc
@@ -56,6 +56,18 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
     options->fds_to_remap.push_back(std::make_pair(sandbox_fd, GetSandboxFD()));
   }
 
+  // (For Electron), if we're launching without zygote, that means we're
+  // launching an unsandboxed process (since all sandboxed processes are
+  // forked from the zygote). Relax the allow_new_privs option to permit
+  // launching suid processes from unsandboxed child processes.
+  ZygoteHandle zygote_handle =
+      base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kNoZygote)
+          ? nullptr
+          : delegate_->GetZygote();
+  if (!zygote_handle) {
+    options->allow_new_privs = true;
+  }
+
   for (const auto& remapped_fd : file_data_->additional_remapped_fds) {
     options->fds_to_remap.emplace_back(remapped_fd.second.get(),
                                        remapped_fd.first);
