[Android] Define a baseline seccomp-bpf sandbox policy.

content/content_common.gypi

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'dependencies': [
     '../base/base.gyp:base',
     '../components/tracing.gyp:tracing',
     '../net/net.gyp:net',
     '../skia/skia.gyp:skia',
@@ skipping 114 matching lines @@
     'common/android/address_parser.cc',
     'common/android/address_parser.h',
     'common/android/address_parser_internal.cc',
     'common/android/address_parser_internal.h',
     'common/android/common_jni_registrar.cc',
     'common/android/common_jni_registrar.h',
     'common/android/device_telephony_info.cc',
     'common/android/device_telephony_info.h',
     'common/android/hash_set.cc',
     'common/android/hash_set.h',
+    'common/android/sandbox_bpf_base_policy_android.cc',

[jln (very slow on Chromium), 2014/03/31 22:57:43]

Shouldn't we have this in common/sandbox_linux/ with everything else? /android/
would be more justifiable if we didn't have to depend on /sandbox_linux/
anyways.

Feel free to rename /sandbox_linux/ to a more encompassing term that includes
Android if you can come up with one.

Having all the policies in one place helps avoiding forgetting about the
dependencies while changing a "base" policy.

I don't feel too strongly about this, so ignore if you prefer.

[Robert Sesek, 2014/04/08 20:33:45]

I don't know if it makes more sense to organize them by OS (which is how most of
//content is organized) or to centralize all the policies in one place. Maybe it
makes the most sense to keep the shared components in
//content/common/sandbox_bpf and then put the OS specific bits in
//content/common/{linux,android}?

[jln (very slow on Chromium), 2014/04/09 05:11:07]

Maybe //content/common/sandbox_bpf/{linux,android} with the common files in the
top directory?

[Robert Sesek, 2014/04/09 21:00:58]

OK that SG. I've moved these into //content/common/sandbox_linux/android for
now. I'll move files around in a followup.

+    'common/android/sandbox_bpf_base_policy_android.h',
     'common/android/surface_texture_lookup.cc',
     'common/android/surface_texture_lookup.h',
     'common/android/surface_texture_peer.cc',
     'common/android/surface_texture_peer.h',
     'common/appcache_messages.h',
     'common/browser_plugin/browser_plugin_constants.cc',
     'common/browser_plugin/browser_plugin_constants.h',
     'common/browser_plugin/browser_plugin_messages.h',
     'common/cc_messages.cc',
     'common/cc_messages.h',
@@ skipping 295 matching lines @@
     'common/view_messages.h',
     'common/webplugin_geometry.cc',
     'common/webplugin_geometry.h',
     'common/websocket.cc',
     'common/websocket.h',
     'common/websocket_messages.h',
     'common/worker_messages.h',
     'common/zygote_commands_linux.h',
     'port/common/input_event_ack_state.h',
   ],
+  'target_conditions': [
+    ['OS=="android"', {
+      'sources/': [
+        ['include', '^common/sandbox_linux/sandbox_bpf_base_policy_linux\\.cc$'],
+        ['include', '^common/sandbox_linux/sandbox_bpf_base_policy_linux\\.h$'],
+      ],
+    }],
+  ],
   'conditions': [
     ['use_aura==1', {
       'sources!': [
         'common/cursors/webcursor_mac.mm',
         'common/cursors/webcursor_win.cc',
       ],
     }],
     ['OS=="ios"', {
       # iOS has different user-agent construction utilities, since the
       # version strings is not derived from webkit_version, and follows
@@ skipping 300 matching lines @@
         'common/sandbox_linux/bpf_renderer_policy_linux.cc',
         'common/sandbox_linux/bpf_renderer_policy_linux.h',
         'common/sandbox_linux/sandbox_bpf_base_policy_linux.cc',
         'common/sandbox_linux/sandbox_bpf_base_policy_linux.h',
       ],
     }, {
       'defines': ['USE_SECCOMP_BPF'],
     }],
   ],
 }