Linux sandbox: better APIs with /proc/ arguments

sandbox/linux/seccomp-bpf/sandbox_bpf.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_H_
 #define SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_H_
 
 #include <stdint.h>
 
 #include "base/files/scoped_file.h"
@@ skipping 46 matching lines @@
   // It is possible to stack multiple sandboxes by creating separate "Sandbox"
   // objects and calling "StartSandbox()" on each of them. Please note, that
   // this requires special care, though, as newly stacked sandboxes can never
   // relax restrictions imposed by earlier sandboxes. Furthermore, installing
   // a new policy requires making system calls, that might already be
   // disallowed.
   // Finally, stacking does add more kernel overhead than having a single
   // combined policy. So, it should only be used if there are no alternatives.
   bool StartSandbox(SeccompLevel level) WARN_UNUSED_RESULT;
 
-  // The sandbox needs to be able to access files in "/proc/self/task/". If
+  // The sandbox needs to be able to access files in "/proc/self/". If
   // this directory is not accessible when "StartSandbox()" gets called, the
   // caller must provide an already opened file descriptor by calling
-  // "SetProcTaskFd()".
+  // "SetProcFd()".
   // The sandbox becomes the new owner of this file descriptor and will
   // close it when "StartSandbox()" executes or when the sandbox object
   // disappears.
-  void SetProcTaskFd(base::ScopedFD proc_task_fd);
+  void SetProcFd(base::ScopedFD proc_fd);
 
   // Checks whether a particular system call number is valid on the current
   // architecture.
   static bool IsValidSyscallNumber(int sysnum);
 
   // UnsafeTraps require some syscalls to always be allowed.
   // This helper function returns true for these calls.
   static bool IsRequiredForUnsafeTrap(int sysno);
 
   // From within an UnsafeTrap() it is often useful to be able to execute
@@ skipping 14 matching lines @@
   // through the verifier, iff the program was built in debug mode.
   // But by setting "force_verification", the caller can request that the
   // verifier is run unconditionally. This is useful for unittests.
   scoped_ptr<CodeGen::Program> AssembleFilter(bool force_verification);
 
  private:
   // Assembles and installs a filter based on the policy that has previously
   // been configured with SetSandboxPolicy().
   void InstallFilter(bool must_sync_threads);
 
-  base::ScopedFD proc_task_fd_;
+  base::ScopedFD proc_fd_;
   bool sandbox_has_started_;
   scoped_ptr<bpf_dsl::Policy> policy_;
 
   DISALLOW_COPY_AND_ASSIGN(SandboxBPF);
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_H_