[Android] Define a baseline seccomp-bpf sandbox policy.

content/public/common/content_switches.cc

Index: content/public/common/content_switches.cc
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index 321d96e14e6da3d6a968a0da96a36fdd3f9a8fc7..5f71f61d8062254e538ac80a0766bf9ba12fb62d 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -356,6 +356,10 @@ const char kEnableAcceleratedFixedRootBackground[] =
 const char kEnableAcceleratedOverflowScroll[] =
     "enable-accelerated-overflow-scroll";
 
+// Enables seccomp-bpf support for Android. Requires experimental kernel
+// support. <http://crbug.com/166704>
+const char kEnableAndroidSeccompBPF[] = "enable-android-seccomp-bpf";

[jln (very slow on Chromium), 2014/04/09 05:11:07]

Maybe call it kEnableAndroidSeccompFilter for consistency with
kDisableSeccompFilterSandbox ?

I wonder if we shouldn't just have kDisableSeccompFilterSandbox and
kEnableSeccompFilterSandbox (without specifying Android). Then each OS can
implement its own policy of what is the default and let the command line
override that.

[Robert Sesek, 2014/04/09 21:00:58]

Renamed to match kDisableSeccompFilterSandbox. I'm not sure we need something
more generic, since we expect all our Linux flavors to eventually have
seccomp-bpf, right? I imagine this flag will go away once all the stars align,
though we'll keep the disable switch for testing purposes.

[jln (very slow on Chromium), 2014/04/09 21:56:19]

That works, but I still would think that kEnableSeccompFilterSandbox is better.

What I meant is that I don't see the need for per-OS flags here. We can have two
generic flags, each platform can have its own default and use the flags as
appropriate.
For instance, in Linux, we could use this flag to FORCE a seccomp sandbox
(instead of failing silently if it's disabled - which may be a good thing to do
on Chrome OS). I also fear that we may need this flag as we bring-up new
platforms (Aarch64 / MIPS).

[Robert Sesek, 2014/04/09 22:07:54]

Done.

+
 // Enables LCD text.
 const char kEnableLCDText[]                 = "enable-lcd-text";