Linux sandbox: Allow restricting sched_* on other processes.

sandbox/linux/seccomp-bpf-helpers/baseline_policy.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 #include "sandbox/sandbox_export.h"
 
@@ skipping 14 matching lines @@
  public:
   BaselinePolicy();
   // |fs_denied_errno| is the errno returned when a filesystem access system
   // call is denied.
   explicit BaselinePolicy(int fs_denied_errno);
   virtual ~BaselinePolicy();
 
   virtual bpf_dsl::ResultExpr EvaluateSyscall(
       int system_call_number) const OVERRIDE;
   virtual bpf_dsl::ResultExpr InvalidSyscall() const OVERRIDE;
+  // Returns the pid of the process being sandboxed.
+  pid_t GetCurrentPid() const;

[jln (very slow on Chromium), 2014/09/22 21:56:44]

As per style-guide, this can just be current_pid() instead.

[rickyz (no longer on Chrome), 2014/09/23 06:03:20]

Good to know, removed this for now and will reintroduce in a future CL.

 
  private:
   int fs_denied_errno_;
   pid_t current_pid_;
   DISALLOW_COPY_AND_ASSIGN(BaselinePolicy);
 };
 
 }  // namespace sandbox.
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_