--- a/security/sandbox/linux/launch/SandboxLaunch.cpp
+++ b/security/sandbox/linux/launch/SandboxLaunch.cpp
@@ -236,46 +236,46 @@ SandboxLaunchPrepare(GeckoProcessType aT
 
   // At this point, we know we'll be using sandboxing; generic
   // sandboxing support goes here.  The MOZ_SANDBOXED env var tells
   // the child process whether this is the case.
   aOptions->env_map["MOZ_SANDBOXED"] = "1";
   PreloadSandboxLib(&aOptions->env_map);
   AttachSandboxReporter(&aOptions->fds_to_remap);
 
+  bool canChroot = false;
+  int flags = 0;
+
+  if (aType == GeckoProcessType_Content && level >= 1) {
+      static const bool needSysV = ContentNeedsSysVIPC();
+      if (needSysV) {
+        // Tell the child process so it can adjust its seccomp-bpf
+        // policy.
+        aOptions->env_map["MOZ_SANDBOX_ALLOW_SYSV"] = "1";
+      } else {
+        flags |= CLONE_NEWIPC;
+      }
+  }
+
   // Anything below this requires unprivileged user namespaces.
   if (!info.Test(SandboxInfo::kHasUserNamespaces)) {
     return;
   }
 
-  bool canChroot = false;
-  int flags = 0;
-
   switch (aType) {
 #ifdef MOZ_GMP_SANDBOX
   case GeckoProcessType_GMPlugin:
     if (level >= 1) {
       canChroot = true;
       flags |= CLONE_NEWNET | CLONE_NEWIPC;
     }
     break;
 #endif
 #ifdef MOZ_CONTENT_SANDBOX
   case GeckoProcessType_Content:
-    if (level >= 1) {
-      static const bool needSysV = ContentNeedsSysVIPC();
-      if (needSysV) {
-        // Tell the child process so it can adjust its seccomp-bpf
-        // policy.
-        aOptions->env_map["MOZ_SANDBOX_ALLOW_SYSV"] = "1";
-      } else {
-        flags |= CLONE_NEWIPC;
-      }
-    }
-
     if (level >= 4) {
       canChroot = true;
       // Unshare network namespace if allowed by graphics; see
       // function definition above for details.  (The display
       // local-ness is cached because it won't change.)
       static const bool isDisplayLocal = IsDisplayLocal();
       if (isDisplayLocal) {
         flags |= CLONE_NEWNET;