Linux sandbox: restrict setpriority() in baseline policy.

Linux sandbox: restrict {set,get}priority() in baseline policy.

In the baseline policy, we restrict setpriority() to
|which| == PRIO_PROCESS and (|who| == 0) || (|who| == current_pid).

This doesn't affect most policies which allow setpriority()
unconditionally but allows baseline unittests to pass on Android.

BUG=398611, 399473
R=mdempsky@chromium.org

Committed: https://crrev.com/a007c724bf0aea0450abf43daefa3b0a4e298bd2
Cr-Commit-Position: refs/heads/master@{#294422}

[jln (very slow on Chromium), 2014-09-09 02:13:55]

Patchset #1 (id:1) has been deleted

[jln (very slow on Chromium), 2014-09-09 02:18:43]

jln@chromium.org changed reviewers:
+ mdempsky@chromium.org

[jln (very slow on Chromium), 2014-09-09 02:18:49]

Matthew: PTAL!

[mdempsky, 2014-09-11 17:40:24]

lgtm

https://codereview.chromium.org/430363003/diff/40001/sandbox/linux/seccomp-bp...
File sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
(right):

https://codereview.chromium.org/430363003/diff/40001/sandbox/linux/seccomp-bp...
sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc:247:
bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid) {
There's a "using bpf_dsl::ResultExpr" declaration in this file, so you can use
just "ResultExpr" here.

[jln (very slow on Chromium), 2014-09-11 17:46:32]

https://codereview.chromium.org/430363003/diff/40001/sandbox/linux/seccomp-bp...
File sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
(right):

https://codereview.chromium.org/430363003/diff/40001/sandbox/linux/seccomp-bp...
sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc:247:
bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid) {
On 2014/09/11 17:40:24, mdempsky wrote:
> There's a "using bpf_dsl::ResultExpr" declaration in this file, so you can use
> just "ResultExpr" here.

Done.

[jln (very slow on Chromium), 2014-09-11 17:46:48]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2014-09-11 18:09:33]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patchset/430363003/60001

[jln (very slow on Chromium), 2014-09-11 18:23:13]

Committed patchset #3 (id:60001) to pending queue manually as e3f8858 (presubmit
successful).

[commit-bot: I haz the power, 2014-09-11 18:43:09]

Patchset 3 (id:??) landed as
https://crrev.com/a007c724bf0aea0450abf43daefa3b0a4e298bd2
Cr-Commit-Position: refs/heads/master@{#294422}