WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

sandbox/linux/services/syscall_wrappers.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_
 #define SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_
 
 #include <stdint.h>
 #include <sys/types.h>
 
+#include "sandbox/linux/system_headers/linux_signal.h"
 #include "sandbox/sandbox_export.h"
 
 struct sock_fprog;
 struct rlimit64;
 struct cap_hdr;
 struct cap_data;
 
 namespace sandbox {
 
 // Provide direct system call wrappers for a few common system calls.
@@ skipping 28 matching lines @@
                                  int resource,
                                  const struct rlimit64* new_limit,
                                  struct rlimit64* old_limit);
 
 // Some libcs do not expose capget/capset wrappers. We want to use these
 // directly in order to avoid pulling in libcap2.
 SANDBOX_EXPORT int sys_capget(struct cap_hdr* hdrp, struct cap_data* datap);
 SANDBOX_EXPORT int sys_capset(struct cap_hdr* hdrp,
                               const struct cap_data* datap);
 
+// Some libcs do not expose sigprocmask/sigaction wrappers.
+SANDBOX_EXPORT int sys_sigprocmask(int how, const linux_sigset_t* set,
+                                   linux_sigset_t* oldset);
+SANDBOX_EXPORT int sys_sigaction(int signum, const struct linux_sigaction* act,
+                                 struct linux_sigaction* oldact);
+
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_