unshare on parent Zygote only

Calling unshare on child Zygotes crash at a sanity check but they end up inheriting the namespace either way.

closes #1

module/jni/main.cpp

@@ -56,6 +56,18 @@ public:
         {
             LOGD("Creating new mount namespace for parent pid=%d uid=%d", getpid(), args->uid);
 
+            /*
+             * preAppSpecialize is before ensureInAppMountNamespace.
+             * postAppSpecialize is after seccomp setup.
+             * So we unshare here to create a pseudo app mount namespace
+             */
+            if (unshare(CLONE_NEWNS) == -1)
+            {
+                LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno));
+                // Don't unmount anything in global namespace
+                return;
+            }
+
             /*
              * Mount the pseudo app mount namespace's root as MS_SLAVE, so every mount/umount from
              * Zygote shared pre-specialization mountspace is propagated to this one.
@@ -64,6 +76,7 @@ public:
             {
                 LOGE("mount(\"rootfs\", \"/\", NULL, (MS_SLAVE | MS_REC), NULL) returned -1");
             }
+        }
 
         do_unmount();
     }