Linux sandbox: Restrict sched_* syscalls on the GPU and ppapi processes.

content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h

Index: content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h
diff --git a/content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h b/content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h
index 7f3b8946943895408aede338e5b35a3f6a95a3f8..6454fba1f132ec423fb55aae902a14e42966ece3 100644
--- a/content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h
+++ b/content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h
@@ -36,6 +36,8 @@ class SandboxBPFBasePolicy : public sandbox::bpf_dsl::SandboxBPFDSLPolicy {
   // Get the errno(3) to return for filesystem errors.
   static int GetFSDeniedErrno();
 
+  pid_t current_pid() const { return baseline_policy_->current_pid(); }

[jln (very slow on Chromium), 2014/09/26 23:03:36]

Style: sorry, but for this one you'll need to do GetCurrentPid() since it's not
a direct member.

How about GetPolicyPid() instead? I'm slightly regretting I called it "current
pid".

[rickyz (Google), 2014/09/27 01:38:37]

Done - renamed the rest of the instances as well

+
  private:
   // Compose the BaselinePolicy from sandbox/.
   scoped_ptr<sandbox::BaselinePolicy> baseline_policy_;