Update from chromium https://crrev.com/301315

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <sched.h>
 #include <sys/syscall.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "base/bind.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/sys_info.h"
 #include "base/threading/thread.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
+#include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/syscall.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 #include "sandbox/linux/tests/unit_tests.h"
 
 #if !defined(OS_ANDROID)
 #include "third_party/lss/linux_syscall_support.h"  // for MAKE_PROCESS_CPUCLOCK
 #endif
 
 namespace sandbox {
 
 namespace {
 
 // NOTE: most of the parameter restrictions are tested in
 // baseline_policy_unittest.cc as a more end-to-end test.
 
 using sandbox::bpf_dsl::Allow;
 using sandbox::bpf_dsl::ResultExpr;
-using sandbox::bpf_dsl::SandboxBPFDSLPolicy;
 
-class RestrictClockIdPolicy : public SandboxBPFDSLPolicy {
+class RestrictClockIdPolicy : public bpf_dsl::Policy {
  public:
   RestrictClockIdPolicy() {}
   virtual ~RestrictClockIdPolicy() {}
 
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     switch (sysno) {
       case __NR_clock_gettime:
       case __NR_clock_getres:
         return RestrictClockID();
       default:
@@ skipping 31 matching lines @@
 
 // A custom BPF tester delegate to run IsRunningOnChromeOS() before
 // the sandbox is enabled because we cannot run it with non-SFI BPF
 // sandbox enabled.
 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate {
  public:
   ClockSystemTesterDelegate()
       : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {}
   virtual ~ClockSystemTesterDelegate() {}
 
-  virtual scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy>
-  GetSandboxBPFPolicy() override {
-    return scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy>(
-        new RestrictClockIdPolicy());
+  virtual scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override {
+    return scoped_ptr<sandbox::bpf_dsl::Policy>(new RestrictClockIdPolicy());
   }
   virtual void RunTestFunction() override {
     if (is_running_on_chromeos_) {
       CheckClock(base::TimeTicks::kClockSystemTrace);
     } else {
       struct timespec ts;
       // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of
       // the init process (pid=1). If kernel supports this feature,
       // this may succeed even if this is not running on Chrome OS. We
       // just check this clock_gettime call does not crash.
@@ skipping 29 matching lines @@
   // and it might not work inside the sandbox anyway.
   const pid_t kInitPID = 1;
   const clockid_t kInitCPUClockID =
       MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
 
   struct timespec ts;
   clock_gettime(kInitCPUClockID, &ts);
 }
 #endif  // !defined(OS_ANDROID)
 
-class RestrictSchedPolicy : public SandboxBPFDSLPolicy {
+class RestrictSchedPolicy : public bpf_dsl::Policy {
  public:
   RestrictSchedPolicy() {}
   virtual ~RestrictSchedPolicy() {}
 
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     switch (sysno) {
       case __NR_sched_getparam:
         return RestrictSchedTarget(getpid(), sysno);
       default:
         return Allow();
@@ skipping 48 matching lines @@
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  RestrictSchedPolicy) {
   const pid_t kInitPID = 1;
   struct sched_param param;
   sched_getparam(kInitPID, &param);
 }
 
 }  // namespace
 
 }  // namespace sandbox