Upstream: Renderers are running in WebAPKs.

chrome/android/webapk/shell_apk/AndroidManifest.xml

 <?xml version="1.0" encoding="utf-8"?>
 <!-- Copyright 2015 The Chromium Authors. All rights reserved.
      Use of this source code is governed by a BSD-style license that can be
      found in the LICENSE file.
 -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     package="{{ manifest_package }}"
     android:versionCode="1"
     android:versionName="1.0" >
 
@@ skipping 22 matching lines @@
         <meta-data android:name="hostUrl" android:value="{{ host_url }}" />
         <meta-data android:name="scope" android:value="{{ scope_url }}" />
         <service
             android:name="org.chromium.webapk.shell_apk.WebApkServiceFactory"
             android:exported="true">
             <intent-filter>
               <action android:name="android.intent.action.MAIN" />
               <category android:name="android.intent.category.WEBAPK_API" />
             </intent-filter>
         </service>
+        <meta-data android:name="org.chromium.content.browser.NUM_SANDBOXED_SERVICES"
+            android:value="3"/>
+        <service android:name="org.chromium.webapk.lib.common.WebApkSandboxedProcessService0"
+            android:isolatedProcess="true"
+            android:process=":webapk_sandboxed_process0"
+            android:exported="true"/>

[pkotwicz, 2016/06/10 21:29:47]

- Looking at chrome/android/java/AndroidManifest.xml the sandboxed services
specify an android:permission do we need to this here too?
- I think that you need tools:ignore="ExportedService" otherwise proguard
complains

[Xi Han, 2016/06/13 20:04:11]

Add tools:ignore="ExportedService".

Hmmm, if we specify a permission here, does that mean Chrome needs to declare
all these permissions if Chrome wants to connect to WebAPKs' child process?

[pkotwicz, 2016/06/14 01:19:48]

I think that Chrome would have to declare the permission if it wants to connect
with the WebAPK. Chrome's sandboxed renderers use a permission with "signature"
protectionLevel. On second thought, I do not know whether we want to use that
for the WebAPK's sandboxed renderers. Should Chrome and WebAPKs have the same
signature?

[Xi Han, 2016/06/14 21:55:03]

I think WebAPK will be signed by using Chromium keys, same as dev/beta/canary,
but Chrome is signed with Google's key. On the other side, if each WebAPK
declares its own permission for the child process service, while we have to make
Chrome declare all these permissions if Chrome wants to connect to WebAPKs,
which is impossible.

+        <service android:name="org.chromium.webapk.lib.common.WebApkSandboxedProcessService1"
+            android:isolatedProcess="true"
+            android:process=":webapk_sandboxed_process1"
+            android:exported="true"/>
+        <service android:name="org.chromium.webapk.lib.common.WebApkSandboxedProcessService2"
+            android:isolatedProcess="true"
+            android:process=":webapk_sandboxed_process2"
+            android:exported="true"/>
     </application>
 </manifest>