WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

sandbox/linux/bpf_dsl/codegen.cc

Index: sandbox/linux/bpf_dsl/codegen.cc
diff --git a/sandbox/linux/bpf_dsl/codegen.cc b/sandbox/linux/bpf_dsl/codegen.cc
index 793d95d8ac6b84200049811ed2b7215c84cf36fb..bc2c7a29464233de9668cb2a606124c415b88830 100644
--- a/sandbox/linux/bpf_dsl/codegen.cc
+++ b/sandbox/linux/bpf_dsl/codegen.cc
@@ -4,12 +4,11 @@
 
 #include "sandbox/linux/bpf_dsl/codegen.h"
 
-#include <linux/filter.h>
-
 #include <limits>
 #include <utility>
 
 #include "base/logging.h"
+#include "sandbox/linux/system_headers/linux_filter.h"
 
 // This CodeGen implementation strives for simplicity while still
 // generating acceptable BPF programs under typical usage patterns
@@ -132,7 +131,8 @@ CodeGen::Node CodeGen::Append(uint16_t code, uint32_t k, size_t jt, size_t jf) {
   CHECK_EQ(program_.size(), equivalent_.size());
 
   Node res = program_.size();
-  program_.push_back(sock_filter{code, jt, jf, k});
+  program_.push_back(sock_filter{
+      code, static_cast<uint8_t>(jt), static_cast<uint8_t>(jf), k});
   equivalent_.push_back(res);
   return res;
 }