Assigning to egemih@ as the owner of mimo-monitor and huddly-monitor. This is the top crasher of M69.

One small inconvenience is that the easiest way of conditionally deciding whether or not to add the -N flag needs to be done in the exec/script stanza (since Upstart does not allow other stanzas to modify env variables: http://upstart.ubuntu.com/cookbook/#environment-variables ). that is at odds with the "expect fork" stanza in all the .conf scripts.

one alternative is to split the .conf in two such that one invokes the other with the correct set of flags, but it seems kind of clunky.

another alternative is to make minijail0 not abort() when asking to enter an invalid cgroup namespace, but no other namespace has this property of being able to soft-fail and I'd rather not open that can of worms.

Oh almost forgot, another alternative (probably the cleanest) is to make all these services raise the SIGSTOP signal and change the stanza from "expect fork" to "expect stop": http://upstart.ubuntu.com/cookbook/#expect-stop

for now, i would just drop the -N flag from any daemon that expects to be run on 3.8/3.10 devices.  it's what we've been doing elsewhere.

we opted to not change minijail to silently ignore -N on older systems.

does SIGSTOP allow for any forking of children ?  if not, that won't be as useful :(.

Ugh, I misinterpreted the documentation to mean that 'expect stop' would both tell upstart what the PID to be tracked is AND the moment in which it has finished initializing, but that's not the case[1]. Dropping the -N flag seems straightforward, so https://chromium-review.googlesource.com/q/topic:%22fizz_cgroup_namespaces%22+(status:open%20OR%20status:merged) should fix all the crashes.

Mostly for my own reference, tryjob posted here: https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?buildbucketId=8941375536239901072

1: https://bugs.launchpad.net/upstart-cookbook/+bug/1394744

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/cfm-device-monitor/+/8e6c28caa1ab93e3efea4fe81ae03c29cd37b870

commit 8e6c28caa1ab93e3efea4fe81ae03c29cd37b870
Author: Luis Hector Chavez <lhchavez@google.com>
Date: Wed Jul 11 01:47:29 2018

Stop requesting entering a cgroup namespace

This change avoids passing the -N flag to minijail0 since both
huddly-monitor and mimo-monitor run on kernels that don't support cgroup
namespaces. This avoids a crash on such older devices.

BUG= chromium:861994 
TEST=fizz tryjob

Change-Id: If99ccdf2cd14b4effa8a4cf06ea3db387ac11468
Reviewed-on: https://chromium-review.googlesource.com/1131535
Commit-Ready: Luis Hector Chavez <lhchavez@chromium.org>
Tested-by: Luis Hector Chavez <lhchavez@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/8e6c28caa1ab93e3efea4fe81ae03c29cd37b870/init/huddly-monitor.conf
[modify] https://crrev.com/8e6c28caa1ab93e3efea4fe81ae03c29cd37b870/init/mimo-monitor.conf

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/8c0535ca8583848f2be8a3cef554f9eba728ea1c

commit 8c0535ca8583848f2be8a3cef554f9eba728ea1c
Author: Luis Hector Chavez <lhchavez@google.com>
Date: Wed Jul 11 19:13:10 2018

cecservice: Stop requesting entering a cgroup namespace

This change avoids passing the -N flag to minijail0 since cecservice run
on kernels that don't support cgroup namespaces. This avoids a crash on
such older devices.

BUG= chromium:861994 
TEST=fizz tryjob

Change-Id: I669dc3b0186e8b8c3e63ea22745d089f1e98f84b
Reviewed-on: https://chromium-review.googlesource.com/1131540
Commit-Ready: Luis Hector Chavez <lhchavez@chromium.org>
Tested-by: Luis Hector Chavez <lhchavez@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/8c0535ca8583848f2be8a3cef554f9eba728ea1c/cecservice/share/cecservice.conf

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/atrusctl/+/f2f9d8df9f307aea2f0c269c81ab7f104b8a4a20

commit f2f9d8df9f307aea2f0c269c81ab7f104b8a4a20
Author: Luis Hector Chavez <lhchavez@google.com>
Date: Thu Jul 12 18:35:40 2018

Clean up the minijail0 invocation

This change uses /var/empty as the chroot to match the way we invoke the
rest of the services. It also stops creating/deleting the chroot
directory.

BUG=b:65450844
BUG= chromium:849455 
BUG= chromium:861994 
TEST=fizz tryjob

Change-Id: I6a76cc92d93bdb8f7edf2990cb0cf219ac20f4ff
Reviewed-on: https://chromium-review.googlesource.com/1087681
Commit-Ready: Luis Hector Chavez <lhchavez@chromium.org>
Tested-by: Luis Hector Chavez <lhchavez@chromium.org>
Reviewed-by: Emil Lundmark <lndmrk@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/f2f9d8df9f307aea2f0c269c81ab7f104b8a4a20/init/atrusd.conf