Linux sandbox: Restrict sched_* syscalls on the GPU and ppapi processes.

content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
@@ skipping 18 matching lines @@
   // is passed to the BPF compiler and the sandbox is engaged.
   // If PreSandboxHook() returns true, the sandbox is guaranteed to be
   // engaged afterwards.
   // This will be used when enabling the sandbox though
   // SandboxSeccompBPF::StartSandbox().
   virtual bool PreSandboxHook();
 
   // Get the errno(3) to return for filesystem errors.
   static int GetFSDeniedErrno();
 
+  pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); }
+
  private:
   // Compose the BaselinePolicy from sandbox/.
   scoped_ptr<sandbox::BaselinePolicy> baseline_policy_;
   DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_