Add check for file system access to the sandbox.

chrome/common/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
 import("//build/util/process_version.gni")
 import("//chrome/common/features.gni")
 import("//chrome/process_version_rc_template.gni")  # For branding_file_path.
 import("//mojo/public/tools/bindings/mojom.gni")
 import("//tools/grit/grit_rule.gni")
@@ skipping 191 matching lines @@
     "//crypto",
     "//extensions/common:common_constants",
     "//gin",
     "//google_apis",
     "//gpu/command_buffer/service",
     "//gpu/config",
     "//ipc",
     "//media",
     "//mojo/public/cpp/bindings",
     "//net",
+    "//sandbox/linux:sandbox_services",

[Nico, 2016/09/27 15:39:55]

You're not including a generated header in a chrome header, so this doesn't need
to be a public_deps, a regular deps is enough. Also, the dep should probably
only be added if is_linux (?)

[Greg K, 2016/09/27 17:18:28]

Done.

     "//skia",
     "//third_party/icu",
     "//third_party/kasko:kasko_features",
     "//third_party/re2",
     "//third_party/widevine/cdm:version_h",
     "//third_party/zlib:zip",
     "//ui/accessibility",
     "//ui/base",
     "//ui/gfx/ipc",
     "//ui/gfx/ipc/geometry",
@@ skipping 432 matching lines @@
     "shell_handler_win.mojom",
   ]
 
   public_deps = [
     "//skia/public/interfaces",
     "//url/mojo:url_mojom_gurl",
   ]
 
   use_new_wrapper_types = false
 }