Linux sandbox: Restrict sched_* syscalls on the GPU and ppapi processes.

Linux sandbox: Restrict sched_* syscalls on the GPU and ppapi processes.

BUG=399473, 413855
Committed: https://crrev.com/449de07210aa42f3e6f4e2930dc0a627e4c884fb
Cr-Commit-Position: refs/heads/master@{#297248}

[rickyz (Google), 2014-09-26 22:47:16]

rickyz@google.com changed reviewers:
+ jln@chromium.org, rickyz@google.com

[rickyz (Google), 2014-09-26 22:47:17]

Here's the change to enable sched restrictions on GPU and ppapi processes.  I
ran content_browsertests and browser_tests with no sandbox-related failures -
let me know if you know of any other tests that would be good to run.

[jln (very slow on Chromium), 2014-09-26 23:03:36]

Lgtm with a nit.

Also, could you please link bug 399473 as well since you're restricting
setpriority?

Let's not land this until Monday so that we don't send a risky non field-tested
CL to the 39 branch. This can wait M40.

https://codereview.chromium.org/598203004/diff/1/content/common/sandbox_linux...
File content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h (right):

https://codereview.chromium.org/598203004/diff/1/content/common/sandbox_linux...
content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h:39: pid_t
current_pid() const { return baseline_policy_->current_pid(); }
Style: sorry, but for this one you'll need to do GetCurrentPid() since it's not
a direct member.

How about GetPolicyPid() instead? I'm slightly regretting I called it "current
pid".

[rickyz (Google), 2014-09-27 01:38:37]

Thanks, will look at submitting on Monday.

https://codereview.chromium.org/598203004/diff/1/content/common/sandbox_linux...
File content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h (right):

https://codereview.chromium.org/598203004/diff/1/content/common/sandbox_linux...
content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h:39: pid_t
current_pid() const { return baseline_policy_->current_pid(); }
On 2014/09/26 23:03:36, jln (slow on IPC reviews) wrote:
> Style: sorry, but for this one you'll need to do GetCurrentPid() since it's
not
> a direct member.
> 
> How about GetPolicyPid() instead? I'm slightly regretting I called it "current
> pid".

Done - renamed the rest of the instances as well

[rickyz (no longer on Chrome), 2014-09-29 19:27:33]

The CQ bit was checked by rickyz@chromium.org

[commit-bot: I haz the power, 2014-09-29 19:29:02]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/598203004/20001

[commit-bot: I haz the power, 2014-09-29 20:36:48]

Committed patchset #2 (id:20001) as 5a14a8dd49c1f00e8cc6114cb256bb70eeb12a32

[commit-bot: I haz the power, 2014-09-29 20:37:39]

Patchset 2 (id:??) landed as
https://crrev.com/449de07210aa42f3e6f4e2930dc0a627e4c884fb
Cr-Commit-Position: refs/heads/master@{#297248}