Improve the browser sandbox by using the new flags on android

and renamed the patch name

build/bromite_patches_list.txt

@@ -206,7 +206,7 @@ AudioBuffer-AnalyserNode-fp-mitigations.patch
 00Disable-visited-pseudo-class.patch
 00Add-setting-to-clear-data-on-exit.patch
 00WIN-Disable-sharing-hub.patch
-00WIN-Enable-Network-Service-Sandbox-and-CIG.patch
+Improve-the-browser-sandbox.patch
 00Disable-csp-reports.patch
 00Fonts-fingerprinting-mitigation.patch
 00Keyboard-protection-flag.patch

build/patches/Improve-the-browser-sandbox.patch

@@ -1,12 +1,15 @@
 From: uazo <uazo@users.noreply.github.com>
 Date: Fri, 17 Feb 2023 16:23:20 +0000
-Subject: WIN Enable Network Service Sandbox and CIG
+Subject: Improve the browser sandbox
+
+by enabling network service sandbox and CIG in windows and
+using the new flags on android
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  chrome/browser/chrome_content_browser_client.cc | 2 +-
- sandbox/policy/features.cc                      | 6 +++++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
+ sandbox/policy/features.cc                      | 7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
 
 diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
 --- a/chrome/browser/chrome_content_browser_client.cc
@@ -23,19 +26,17 @@ diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/ch
 diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc
 --- a/sandbox/policy/features.cc
 +++ b/sandbox/policy/features.cc
-@@ -18,8 +18,12 @@ namespace sandbox::policy::features {
- // Enables network service sandbox.
- // (Only causes an effect when feature kNetworkServiceInProcess is disabled.)
- BASE_FEATURE(kNetworkServiceSandbox,
--             "NetworkServiceSandbox",
-+             "NetworkServiceSandbox", // enabled only in windows
-+#if BUILDFLAG(IS_WIN)
-+             base::FEATURE_ENABLED_BY_DEFAULT);
-+#else
-              base::FEATURE_DISABLED_BY_DEFAULT);
-+#endif
+@@ -194,4 +194,11 @@ bool IsNetworkSandboxEnabled() {
+ #endif  // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
+ }
  
- #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
- // Enables a fine-grained seccomp-BPF syscall filter for the network service.
++#if BUILDFLAG(IS_ANDROID)
++SET_CROMITE_FEATURE_ENABLED(kUseRendererProcessPolicy);
++SET_CROMITE_FEATURE_ENABLED(kRestrictRendererPoliciesInBaseline);
++#endif
++#if BUILDFLAG(IS_WIN)
++SET_CROMITE_FEATURE_ENABLED(kNetworkServiceSandbox);
++#endif
+ }  // namespace sandbox::policy::features
 --
 2.25.1