Implement GetSandboxType() on all platforms and implement for all process types.

content/public/browser/content_browser_client.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_
 #define CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_
 
 #include <map>
 #include <string>
 #include <utility>
@@ skipping 622 matching lines @@
 
 #if defined(OS_WIN)
   // Returns the name of the dll that contains cursors and other resources.
   virtual const wchar_t* GetResourceDllName();
 
   // This is called on the PROCESS_LAUNCHER thread before the renderer process
   // is launched. It gives the embedder a chance to add loosen the sandbox
   // policy.
   virtual void PreSpawnRenderer(sandbox::TargetPolicy* policy,
                                 bool* success) {}
+
+  // Returns the App Container SID for the specified sandboxed process type, or
+  // empty string if this sandboxed process type does not support living inside
+  // an App Container.
+  virtual base::string16 GetAppContainerSidForSandboxType(

[nasko, 2015/06/19 12:18:19]

I don't see an implementation of this interface for content_shell. Is this
intentional? It might lead to browser tests running the renderers without an
AppContainer, which is not going to be matching real browser build.

[Will Harris, 2015/06/23 16:21:11]

There's quite a few subclasses of ContentBrowserClient:

ShellContentBrowserClient
TestContentBrowserClient
ViewsContentBrowserClient

Perhaps implement a single SID version inside ContentBrowserClient and then make
ChromeContentBrowserClient override and be aware of GOOGLE_CHROME_BUILD. Not
entirely sure what is best here to ensure full test coverage.

[nasko, 2015/06/24 08:04:08]

Indeed, that sounds like the right approach to me. This is why we have basic
implementations in the ContentBrowserClient, such that we have some sane default
and each other client can provide a different implementation.

I'd suggest returning some value from ContentBrowserClient that will ensure we
get AppContainer support, but not worrying too much that it matches the actual
production setup.

[Will Harris, 2015/06/24 11:37:09]

Done.

+      int sandbox_type) const;
 #endif
 
 #if defined(VIDEO_HOLE)
   // Allows an embedder to provide its own ExternalVideoSurfaceContainer
   // implementation.  Return nullptr to disable external surface video.
   virtual ExternalVideoSurfaceContainer*
   OverrideCreateExternalVideoSurfaceContainer(WebContents* web_contents);
 #endif
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_