[Android] Define a baseline seccomp-bpf sandbox policy.

content/content_common.gypi

Index: content/content_common.gypi
diff --git a/content/content_common.gypi b/content/content_common.gypi
index 16efa4b5d02ce2c646024fd76ca318b091241f6a..43b782922d3b610d27f5996a0d1e96f654d0b7bc 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -132,6 +132,8 @@
     'common/android/device_telephony_info.h',
     'common/android/hash_set.cc',
     'common/android/hash_set.h',
+    'common/android/sandbox_bpf_base_policy_android.cc',

[jln (very slow on Chromium), 2014/03/31 22:57:43]

Shouldn't we have this in common/sandbox_linux/ with everything else? /android/
would be more justifiable if we didn't have to depend on /sandbox_linux/
anyways.

Feel free to rename /sandbox_linux/ to a more encompassing term that includes
Android if you can come up with one.

Having all the policies in one place helps avoiding forgetting about the
dependencies while changing a "base" policy.

I don't feel too strongly about this, so ignore if you prefer.

[Robert Sesek, 2014/04/08 20:33:45]

I don't know if it makes more sense to organize them by OS (which is how most of
//content is organized) or to centralize all the policies in one place. Maybe it
makes the most sense to keep the shared components in
//content/common/sandbox_bpf and then put the OS specific bits in
//content/common/{linux,android}?

[jln (very slow on Chromium), 2014/04/09 05:11:07]

Maybe //content/common/sandbox_bpf/{linux,android} with the common files in the
top directory?

[Robert Sesek, 2014/04/09 21:00:58]

OK that SG. I've moved these into //content/common/sandbox_linux/android for
now. I'll move files around in a followup.

+    'common/android/sandbox_bpf_base_policy_android.h',
     'common/android/surface_texture_lookup.cc',
     'common/android/surface_texture_lookup.h',
     'common/android/surface_texture_peer.cc',
@@ -447,6 +449,14 @@
     'common/zygote_commands_linux.h',
     'port/common/input_event_ack_state.h',
   ],
+  'target_conditions': [
+    ['OS=="android"', {
+      'sources/': [
+        ['include', '^common/sandbox_linux/sandbox_bpf_base_policy_linux\\.cc$'],
+        ['include', '^common/sandbox_linux/sandbox_bpf_base_policy_linux\\.h$'],
+      ],
+    }],
+  ],
   'conditions': [
     ['use_aura==1', {
       'sources!': [