WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

sandbox/linux/system_headers/linux_seccomp.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_
 #define SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_
 
-#include <linux/filter.h>
-
 // The Seccomp2 kernel ABI is not part of older versions of glibc.
 // As we can't break compilation with these versions of the library,
 // we explicitly define all missing symbols.
 // If we ever decide that we can now rely on system headers, the following
 // include files should be enabled:
 // #include <linux/audit.h>
 // #include <linux/seccomp.h>
 
 // For audit.h
 #ifndef EM_ARM
@@ skipping 40 matching lines @@
 #define PR_GET_SECCOMP               21
 #endif
 #ifndef PR_SET_NO_NEW_PRIVS
 #define PR_SET_NO_NEW_PRIVS          38
 #define PR_GET_NO_NEW_PRIVS          39
 #endif
 #ifndef IPC_64
 #define IPC_64                   0x0100
 #endif
 
-#ifndef BPF_MOD
-#define BPF_MOD                    0x90
-#endif
-#ifndef BPF_XOR
-#define BPF_XOR                    0xA0
-#endif
-
 // In order to build will older tool chains, we currently have to avoid
 // including <linux/seccomp.h>. Until that can be fixed (if ever). Rely on
 // our own definitions of the seccomp kernel ABI.
 #ifndef SECCOMP_MODE_FILTER
 #define SECCOMP_MODE_DISABLED         0
 #define SECCOMP_MODE_STRICT           1
 #define SECCOMP_MODE_FILTER           2  // User user-supplied filter
 #endif
 
 #ifndef SECCOMP_SET_MODE_STRICT
@@ skipping 20 matching lines @@
 #define SECCOMP_RET_DATA    0x0000ffffU  //   sections
 #else
 #define SECCOMP_RET_INVALID 0x00010000U  // Illegal return value
 #endif
 
 #ifndef SYS_SECCOMP
 #define SYS_SECCOMP                   1
 #endif
 
 #endif  // SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_