Add seccomp sandbox for non-SFI NaCl

components/nacl/loader/nacl_helper_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A mini-zygote specifically for Native Client.
 
 #include "components/nacl/loader/nacl_helper_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
@@ skipping 13 matching lines @@
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/posix/global_descriptors.h"
 #include "base/posix/unix_domain_socket_linux.h"
 #include "base/process/kill.h"
 #include "base/rand_util.h"
 #include "components/nacl/common/nacl_switches.h"
 #include "components/nacl/loader/nacl_listener.h"
 #include "components/nacl/loader/nacl_sandbox_linux.h"
+#include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 #include "content/public/common/zygote_fork_delegate_linux.h"
 #include "crypto/nss_util.h"
 #include "ipc/ipc_descriptors.h"
 #include "ipc/ipc_switches.h"
 #include "sandbox/linux/services/libc_urandom_override.h"
 
 namespace {
 
 struct NaClLoaderSystemInfo {
   size_t prereserved_sandbox_size;
@@ skipping 14 matching lines @@
   if (uses_nonsfi_mode) {
     const bool can_be_no_sandbox = CommandLine::ForCurrentProcess()->HasSwitch(
         switches::kNaClDangerousNoSandboxNonSfi);
     const bool setuid_sandbox_enabled = IsSandboxed();
     if (!setuid_sandbox_enabled) {
       if (can_be_no_sandbox)
         LOG(ERROR) << "DANGEROUS: Running non-SFI NaCl without SUID sandbox!";
       else
         LOG(FATAL) << "SUID sandbox is mandatory for non-SFI NaCl";
     }
-    const bool bpf_sandbox_initialized = InitializeBPFSandbox();
+    const bool bpf_sandbox_initialized = nacl::nonsfi::InitializeBPFSandbox();
     if (!bpf_sandbox_initialized) {
       if (can_be_no_sandbox) {
         LOG(ERROR)
             << "DANGEROUS: Running non-SFI NaCl without seccomp-bpf sandbox!";
       } else {
         LOG(FATAL) << "Could not initialize NaCl's second "
                    << "layer sandbox (seccomp-bpf) for non-SFI mode.";
       }
     }
   } else {
@@ skipping 343 matching lines @@
   // Now handle requests from the Zygote.
   while (true) {
     bool request_handled = HandleZygoteRequest(kNaClZygoteDescriptor,
                                                system_info);
     // Do not turn this into a CHECK() without thinking about robustness
     // against malicious IPC requests.
     DCHECK(request_handled);
   }
   NOTREACHED();
 }