Update from https://crrev.com/316786

sandbox/linux/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/features.gni")
 import("//testing/test.gni")
 
 declare_args() {
   compile_suid_client = is_linux
 
@@ skipping 48 matching lines @@
       "seccomp-bpf/sandbox_bpf_test_runner.cc",
       "seccomp-bpf/sandbox_bpf_test_runner.h",
     ]
     deps += [ ":seccomp_bpf" ]
   }
 }
 
 # The main sandboxing test target.
 test("sandbox_linux_unittests") {
   sources = [
+    "services/proc_util_unittest.cc",
+    "services/resource_limits_unittests.cc",
     "services/scoped_process_unittest.cc",
     "services/syscall_wrappers_unittest.cc",
     "services/thread_helpers_unittests.cc",
     "services/yama_unittests.cc",
     "syscall_broker/broker_file_permission_unittest.cc",
     "syscall_broker/broker_process_unittest.cc",
     "tests/main.cc",
     "tests/scoped_temporary_file.cc",
     "tests/scoped_temporary_file.h",
     "tests/scoped_temporary_file_unittest.cc",
@@ skipping 15 matching lines @@
   }
 
   if (compile_suid_client) {
     sources += [
       "suid/client/setuid_sandbox_client_unittest.cc",
       "suid/client/setuid_sandbox_host_unittest.cc",
     ]
   }
   if (use_seccomp_bpf) {
     sources += [
-      "bpf_dsl/bpf_dsl_more_unittest.cc",
       "bpf_dsl/bpf_dsl_unittest.cc",
       "bpf_dsl/codegen_unittest.cc",
       "bpf_dsl/cons_unittest.cc",
       "bpf_dsl/syscall_set_unittest.cc",
+      "integration_tests/bpf_dsl_seccomp_unittest.cc",
+      "integration_tests/seccomp_broker_process_unittest.cc",
       "seccomp-bpf-helpers/baseline_policy_unittest.cc",
       "seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc",
       "seccomp-bpf/bpf_tests_unittest.cc",
       "seccomp-bpf/errorcode_unittest.cc",
       "seccomp-bpf/sandbox_bpf_unittest.cc",
       "seccomp-bpf/syscall_unittest.cc",
     ]
   }
   if (compile_credentials) {
     sources += [
+      "integration_tests/namespace_unix_domain_socket_unittest.cc",
       "services/credentials_unittest.cc",
       "services/namespace_sandbox_unittest.cc",
       "services/namespace_utils_unittest.cc",
-      "services/proc_util_unittest.cc",
-      "services/unix_domain_socket_unittest.cc",
     ]
   }
 }
 
 # TODO(GYP) Android version of this test.
 #    {
 #      # This target is the shared library used by Android APK (i.e.
 #      # JNI-friendly) tests.
 #      "target_name": "sandbox_linux_jni_unittests",
 #      "includes": [
@@ skipping 13 matching lines @@
   sources = [
     "bpf_dsl/bpf_dsl.cc",
     "bpf_dsl/bpf_dsl.h",
     "bpf_dsl/bpf_dsl_forward.h",
     "bpf_dsl/bpf_dsl_impl.h",
     "bpf_dsl/codegen.cc",
     "bpf_dsl/codegen.h",
     "bpf_dsl/cons.h",
     "bpf_dsl/dump_bpf.cc",
     "bpf_dsl/dump_bpf.h",
+    "bpf_dsl/linux_syscall_ranges.h",
     "bpf_dsl/policy.cc",
     "bpf_dsl/policy.h",
     "bpf_dsl/policy_compiler.cc",
     "bpf_dsl/policy_compiler.h",
+    "bpf_dsl/seccomp_macros.h",
     "bpf_dsl/syscall_set.cc",
     "bpf_dsl/syscall_set.h",
     "bpf_dsl/trap_registry.h",
     "seccomp-bpf/die.cc",
     "seccomp-bpf/die.h",
     "seccomp-bpf/errorcode.cc",
     "seccomp-bpf/errorcode.h",
-    "seccomp-bpf/linux_seccomp.h",
     "seccomp-bpf/sandbox_bpf.cc",
     "seccomp-bpf/sandbox_bpf.h",
     "seccomp-bpf/syscall.cc",
     "seccomp-bpf/syscall.h",
     "seccomp-bpf/trap.cc",
     "seccomp-bpf/trap.h",
     "seccomp-bpf/verifier.cc",
     "seccomp-bpf/verifier.h",
   ]
   defines = [ "SANDBOX_IMPLEMENTATION" ]
@@ skipping 44 matching lines @@
       # TODO fix this and re-enable this warning.
       "-Wno-sign-compare",
     ]
   }
 }
 
 component("sandbox_services") {
   sources = [
     "services/init_process_reaper.cc",
     "services/init_process_reaper.h",
+    "services/proc_util.cc",
+    "services/proc_util.h",
+    "services/resource_limits.cc",
+    "services/resource_limits.h",
     "services/scoped_process.cc",
     "services/scoped_process.h",
     "services/syscall_wrappers.cc",
     "services/syscall_wrappers.h",
     "services/thread_helpers.cc",
     "services/thread_helpers.h",
+    "services/yama.cc",
     "services/yama.h",
-    "services/yama.cc",
     "syscall_broker/broker_channel.cc",
     "syscall_broker/broker_channel.h",
     "syscall_broker/broker_client.cc",
     "syscall_broker/broker_client.h",
     "syscall_broker/broker_common.h",
     "syscall_broker/broker_file_permission.cc",
     "syscall_broker/broker_file_permission.h",
     "syscall_broker/broker_host.cc",
     "syscall_broker/broker_host.h",
     "syscall_broker/broker_policy.cc",
     "syscall_broker/broker_policy.h",
     "syscall_broker/broker_process.cc",
     "syscall_broker/broker_process.h",
   ]
 
   defines = [ "SANDBOX_IMPLEMENTATION" ]
 
   if (compile_credentials) {
     sources += [
       "services/credentials.cc",
       "services/credentials.h",
       "services/namespace_sandbox.cc",
       "services/namespace_sandbox.h",
       "services/namespace_utils.cc",
       "services/namespace_utils.h",
-      "services/proc_util.cc",
-      "services/proc_util.h",
     ]
 
     # For capabilities.cc.
     configs += [ "//build/config/linux:libcap" ]
   }
 
   deps = [
     "//base",
   ]
 }
 
 source_set("sandbox_services_headers") {
   sources = [
-    "services/android_arm_ucontext.h",
-    "services/android_arm64_ucontext.h",
-    "services/android_futex.h",
-    "services/android_ucontext.h",
-    "services/android_i386_ucontext.h",
-    "services/arm_linux_syscalls.h",
-    "services/arm64_linux_syscalls.h",
-    "services/linux_syscalls.h",
-    "services/x86_32_linux_syscalls.h",
-    "services/x86_64_linux_syscalls.h",
+    "system_headers/android_arm64_ucontext.h",
+    "system_headers/android_arm_ucontext.h",
+    "system_headers/android_futex.h",
+    "system_headers/android_i386_ucontext.h",
+    "system_headers/android_ucontext.h",
+    "system_headers/arm64_linux_syscalls.h",
+    "system_headers/arm_linux_syscalls.h",
+    "system_headers/linux_seccomp.h",
+    "system_headers/linux_syscalls.h",
+    "system_headers/x86_32_linux_syscalls.h",
+    "system_headers/x86_64_linux_syscalls.h",
   ]
 }
 
 # We make this its own target so that it does not interfere with our tests.
 source_set("libc_urandom_override") {
   sources = [
     "services/libc_urandom_override.cc",
     "services/libc_urandom_override.h",
   ]
   deps = [
@@ skipping 45 matching lines @@
   #      'type': 'none',
   #      'variables': {
   #        'test_suite_name': 'sandbox_linux_jni_unittests',
   #      },
   #      'dependencies': [
   #        'sandbox_linux_jni_unittests',
   #      ],
   #      'includes': [ '../../build/apk_test.gypi' ],
   #      }
 }