Linux Sandbox: split the GPU policies to their own file.

content/common/sandbox_linux/sandbox_bpf_cros_arm_gpu_policy_linux.h

Index: content/common/sandbox_linux/sandbox_bpf_cros_arm_gpu_policy_linux.h
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h b/content/common/sandbox_linux/sandbox_bpf_cros_arm_gpu_policy_linux.h
similarity index 28%
copy from sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h
copy to content/common/sandbox_linux/sandbox_bpf_cros_arm_gpu_policy_linux.h
index 1ac5daba5d976b8bf9e2d933ff1be6ca90206ea9..a9bf3468afdbfa656489e867d278927051c2e726 100644
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h
+++ b/content/common/sandbox_linux/sandbox_bpf_cros_arm_gpu_policy_linux.h
@@ -2,34 +2,30 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_POLICY_H_
-#define SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_POLICY_H_
+#ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_CROS_ARM_GPU_POLICY_LINUX_H_
+#define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_CROS_ARM_GPU_POLICY_LINUX_H_
 
-#include "base/basictypes.h"
+#include "content/common/sandbox_linux/sandbox_bpf_gpu_policy_linux.h"
 
-namespace sandbox {
+namespace content {
 
-class ErrorCode;
-class SandboxBPF;
-
-// This is the interface to implement to define a BPF sandbox policy.
-class SandboxBPFPolicy {
+// This policy is for Chrome OS ARM.
+class CrosArmGpuProcessPolicy : public GpuProcessPolicy {
  public:
-  SandboxBPFPolicy() {}
-  virtual ~SandboxBPFPolicy() {}
-
-  // The EvaluateSyscall method is called with the system call number. It can
-  // decide to allow the system call unconditionally by returning ERR_ALLOWED;
-  // it can deny the system call unconditionally by returning an appropriate
-  // "errno" value; or it can request inspection of system call argument(s) by
-  // returning a suitable ErrorCode.
+  explicit CrosArmGpuProcessPolicy(bool allow_shmat)

[Robert Sesek, 2013/12/12 21:33:48]

Don't inline ctors and dtors:
http://dev.chromium.org/developers/coding-style/cpp-dos-and-donts#TOC-Stop-in....

[jln (very slow on Chromium), 2013/12/12 22:15:14]

Done.

+      : allow_shmat_(allow_shmat) {}
+  virtual ~CrosArmGpuProcessPolicy() {}
+
   virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
-                                    int system_call_number) const = 0;
+                                    int system_call_number) const OVERRIDE;
+  virtual bool PreSandboxHook() OVERRIDE;
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(SandboxBPFPolicy);
+  const bool allow_shmat_;  // Allow shmat(2).
+  DISALLOW_COPY_AND_ASSIGN(CrosArmGpuProcessPolicy);
 };
 
-}  // namespace sandbox
+}  // namespace content
 
-#endif  // SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_POLICY_H_
+#endif
+// CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_CROS_ARM_GPU_POLICY_LINUX_H_

[Robert Sesek, 2013/12/12 21:33:48]

nit: put on previous line, even if it overflows 80

[jln (very slow on Chromium), 2013/12/12 22:15:14]

Done.