Add SetCapabilities for setting capabilities to an exact set.

sandbox/linux/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/features.gni")
 import("//testing/test.gni")
 
 declare_args() {
   compile_suid_client = is_linux
 
@@ skipping 108 matching lines @@
       "seccomp-bpf/syscall_unittest.cc",
     ]
   }
   if (compile_credentials) {
     sources += [
       "integration_tests/namespace_unix_domain_socket_unittest.cc",
       "services/credentials_unittest.cc",
       "services/namespace_sandbox_unittest.cc",
       "services/namespace_utils_unittest.cc",
     ]
+
+    # For credentials_unittest.cc
+    configs += [ "//build/config/linux:libcap" ]
   }
 }
 
 # The main sandboxing test target.
 test("sandbox_linux_unittests") {
   deps = [
     ":sandbox_linux_unittests_sources",
   ]
 }
 
@@ skipping 119 matching lines @@
     "syscall_broker/broker_host.cc",
     "syscall_broker/broker_host.h",
     "syscall_broker/broker_policy.cc",
     "syscall_broker/broker_policy.h",
     "syscall_broker/broker_process.cc",
     "syscall_broker/broker_process.h",
   ]
 
   defines = [ "SANDBOX_IMPLEMENTATION" ]
 
+  deps = [
+    "//base",
+  ]
+
   if (compile_credentials) {
     sources += [
       "services/credentials.cc",
       "services/credentials.h",
       "services/namespace_sandbox.cc",
       "services/namespace_sandbox.h",
       "services/namespace_utils.cc",
       "services/namespace_utils.h",
     ]
 
-    # For capabilities.cc.
-    configs += [ "//build/config/linux:libcap" ]
+    deps += [ ":sandbox_services_headers" ]
   }
-
-  deps = [
-    "//base",
-  ]
 }
 
 source_set("sandbox_services_headers") {
   sources = [
     "system_headers/android_arm64_ucontext.h",
     "system_headers/android_arm_ucontext.h",
     "system_headers/android_futex.h",
     "system_headers/android_i386_ucontext.h",
     "system_headers/android_ucontext.h",
     "system_headers/arm64_linux_syscalls.h",
@@ skipping 60 matching lines @@
   #      'type': 'none',
   #      'variables': {
   #        'test_suite_name': 'sandbox_linux_jni_unittests',
   #      },
   #      'dependencies': [
   #        'sandbox_linux_jni_unittests',
   #      ],
   #      'includes': [ '../../build/apk_test.gypi' ],
   #      }
 }