WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

sandbox/linux/bpf_dsl/seccomp_macros.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_BPF_DSL_SECCOMP_MACROS_H_
 #define SANDBOX_LINUX_BPF_DSL_SECCOMP_MACROS_H_
 
-#include <asm/unistd.h>
-#include <linux/filter.h>
+#include "build/build_config.h"
 
-#include <sys/cdefs.h>
 // Old Bionic versions do not have sys/user.h.  The if can be removed once we no
 // longer need to support these old Bionic versions.
 // All x86_64 builds use a new enough bionic to have sys/user.h.
 #if !defined(__BIONIC__) || defined(__x86_64__)
 #include <sys/types.h>  // Fix for gcc 4.7, make sure __uint16_t is defined.
+#if !defined(OS_NACL_NONSFI)
 #include <sys/user.h>
+#endif
 #if defined(__mips__)
 // sys/user.h in eglibc misses size_t definition
 #include <stddef.h>
 #endif
 #endif
 
 #include "sandbox/linux/system_headers/linux_seccomp.h"  // For AUDIT_ARCH_*
 
 // Impose some reasonable maximum BPF program size. Realistically, the
 // kernel probably has much lower limits. But by limiting to less than
@@ skipping 18 matching lines @@
 #define SECCOMP_IP_MSB_IDX      (offsetof(struct arch_seccomp_data,           \
                                           instruction_pointer) + 4)
 #define SECCOMP_IP_LSB_IDX      (offsetof(struct arch_seccomp_data,           \
                                           instruction_pointer) + 0)
 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
                                  8*(nr) + 4)
 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
                                  8*(nr) + 0)
 
 
-#if defined(__BIONIC__)
-// Old Bionic versions don't have sys/user.h, so we just define regs_struct
-// directly.  This can be removed once we no longer need to support these old
-// Bionic versions.
+#if defined(__BIONIC__) || defined(OS_NACL_NONSFI)
+// Old Bionic versions and PNaCl toolchain for nacl_helper_nonsfi don't have
+// sys/user.h, so we just define regs_struct directly.  This can be removed
+// once we no longer need to support these old Bionic versions.
 struct regs_struct {
   long int ebx;
   long int ecx;
   long int edx;
   long int esi;
   long int edi;
   long int ebp;
   long int eax;
   long int xds;
   long int xes;
@@ skipping 217 matching lines @@
 #define SECCOMP_PT_PARM3(_regs) (_regs).regs[2]
 #define SECCOMP_PT_PARM4(_regs) (_regs).regs[3]
 #define SECCOMP_PT_PARM5(_regs) (_regs).regs[4]
 #define SECCOMP_PT_PARM6(_regs) (_regs).regs[5]
 #else
 #error Unsupported target platform
 
 #endif
 
 #endif  // SANDBOX_LINUX_BPF_DSL_SECCOMP_MACROS_H_