Apply renderer sandbox to utility processes.

content/common/sandbox_linux/bpf_utility_policy_linux.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_UTILITY_POLICY_LINUX_H_
+#define CONTENT_COMMON_SANDBOX_LINUX_BPF_UTILITY_POLICY_LINUX_H_
+
+#include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
+
+namespace content {
+
+// This policy can be used by both utility processes.

[Jorge Lucangeli Obes, 2014/06/25 00:49:52]

What does "both utility processes" mean here?

[mdempsky, 2014/06/25 00:52:59]

Whoops, fixed.  Originally it was "both renderers and worker processes", and I
only half fixed it.

+class UtilityProcessPolicy : public SandboxBPFBasePolicy {
+ public:
+  UtilityProcessPolicy();
+  virtual ~UtilityProcessPolicy();
+
+  virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
+                                    int system_call_number) const OVERRIDE;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(UtilityProcessPolicy);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_SANDBOX_LINUX_BPF_UTILITY_POLICY_LINUX_H_