WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
-#include <linux/futex.h>
-#include <linux/net.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
-#include <sys/ptrace.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/public/common/sandbox_init.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
+#include "sandbox/linux/system_headers/android_futex.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 
+#if !defined(OS_NACL_NONSFI)
+#include <linux/net.h>  // TODO move SYS_SOCKETPAIR etc to there.
+#include <sys/ptrace.h>
+#endif
+
 #if defined(__arm__) && !defined(MAP_STACK)
 // Chrome OS Daisy (ARM) build environment has old headers.
 #define MAP_STACK 0x20000
 #endif
 
+// TODO
+#if !defined(PR_SET_NAME)
+#define PR_SET_NAME 15
+#endif
+#if !defined(MAP_STACK)
+#define MAP_STACK 0x20000
+#endif
+
 #define CASES SANDBOX_BPF_DSL_CASES
 
 using sandbox::CrashSIGSYS;
 using sandbox::CrashSIGSYSClone;
 using sandbox::CrashSIGSYSFutex;
 using sandbox::CrashSIGSYSPrctl;
 using sandbox::bpf_dsl::Allow;
 using sandbox::bpf_dsl::Arg;
 using sandbox::bpf_dsl::BoolExpr;
 using sandbox::bpf_dsl::Error;
@@ skipping 133 matching lines @@
     case __NR_time:
 #endif
       return true;
 
     default:
       return false;
   }
 }
 
 void RunSandboxSanityChecks() {
+#if !defined(OS_NACL_NONSFI)
+  // TODO: Is this sanity check needed? Can we have alternative?
   errno = 0;
   // Make a ptrace request with an invalid PID.
   long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL);
   CHECK_EQ(-1, ptrace_ret);
   // Without the sandbox on, this ptrace call would ESRCH instead.
   CHECK_EQ(EPERM, errno);
+#endif
 }
 
 }  // namespace
 
 ResultExpr NaClNonSfiBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
     // Allowed syscalls.
 #if defined(__i386__) || defined(__arm__)
     case __NR__llseek:
 #elif defined(__x86_64__)
@@ skipping 104 matching lines @@
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()),
       proc_fd.Pass());
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl