Linux: move hardcoded paths to GYP variables.

build/common.gypi

 # Copyright (c) 2009 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     # .gyp files should set chromium_code to 1 if they build Chromium-specific
     # code, as opposed to external code.  This variable is used to control
     # such things as the set of warnings to enable, and whether warnings are
     # treated as errors.
@@ skipping 72 matching lines @@
     'chromeos%': 0,
 
     'chrome_personalization%': 0,
 
     # Set the restrictions on the SUID sandbox binary.
     #  Path: only exec the hard coded chrome binary path
     #  User: only exec binaries owned by the running user.
     #
     # Developers should read
     #  http://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment
-    'linux_suid_sandbox_restrictions': 'Path',
+    'linux_suid_sandbox_restrictions%': 'Path',
+
+    # This is the location of the sandbox binary. Chrome looks for this before
+    # running the zygote process. If found, and SUID, it will be used to
+    # sandbox the zygote process and, thus, all renderer processes.
+    'linux_sandbox_path%': '',
+
+    # If |linux_suid_sandbox_restrictions|, above, is 'Path' then only a single
+    # path is allowed to be exec'ed by the sandbox for security reasons. That
+    # path is set here. It should be the final location of the Chromium binary
+    # on the system.
+    'linux_sandbox_chrome_path%': '/opt/google/chrome/chrome',
   },
   'target_defaults': {
     'conditions': [
       ['branding=="Chrome"', {
         'defines': ['GOOGLE_CHROME_BUILD'],
         'conditions': [
           ['OS=="linux"', {
             'cflags': [ '-gstabs' ],
           }],
         ],
@@ skipping 499 matching lines @@
     # settings in target dicts.  SYMROOT is a special case, because many other
     # Xcode variables depend on it, including variables such as
     # PROJECT_DERIVED_FILE_DIR.  When a source group corresponding to something
     # like PROJECT_DERIVED_FILE_DIR is added to a project, in order for the
     # files to appear (when present) in the UI as actual files and not red
     # red "missing file" proxies, the correct path to PROJECT_DERIVED_FILE_DIR,
     # and therefore SYMROOT, needs to be set at the project level.
     'SYMROOT': '<(DEPTH)/xcodebuild',
   },
 }