WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

sandbox/linux/bpf_dsl/codegen.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/codegen.h"
 
-#include <linux/filter.h>
-
 #include <limits>
 #include <utility>
 
 #include "base/logging.h"
+#include "sandbox/linux/system_headers/linux_filter.h"
 
 // This CodeGen implementation strives for simplicity while still
 // generating acceptable BPF programs under typical usage patterns
 // (e.g., by PolicyCompiler).
 //
 // The key to its simplicity is that BPF programs only support forward
 // jumps/branches, which allows constraining the DAG construction API
 // to make instruction nodes immutable. Immutable nodes admits a
 // simple greedy approach of emitting new instructions as needed and
 // then reusing existing ones that have already been emitted. This
@@ skipping 102 matching lines @@
     CHECK_LE(jf, kBranchRange);
   } else {
     CHECK_EQ(0U, jt);
     CHECK_EQ(0U, jf);
   }
 
   CHECK_LT(program_.size(), static_cast<size_t>(BPF_MAXINSNS));
   CHECK_EQ(program_.size(), equivalent_.size());
 
   Node res = program_.size();
-  program_.push_back(sock_filter{code, jt, jf, k});
+  program_.push_back(sock_filter{
+      code, static_cast<uint8_t>(jt), static_cast<uint8_t>(jf), k});
   equivalent_.push_back(res);
   return res;
 }
 
 size_t CodeGen::Offset(Node target) const {
   CHECK_LT(target, program_.size()) << "Bogus offset target node";
   return (program_.size() - 1) - target;
 }
 
 // TODO(mdempsky): Move into a general base::Tuple helper library.
 bool CodeGen::MemoKeyLess::operator()(const MemoKey& lhs,
                                       const MemoKey& rhs) const {
   if (get<0>(lhs) != get<0>(rhs))
     return get<0>(lhs) < get<0>(rhs);
   if (get<1>(lhs) != get<1>(rhs))
     return get<1>(lhs) < get<1>(rhs);
   if (get<2>(lhs) != get<2>(rhs))
     return get<2>(lhs) < get<2>(rhs);
   if (get<3>(lhs) != get<3>(rhs))
     return get<3>(lhs) < get<3>(rhs);
   return false;
 }
 
 }  // namespace sandbox