add restricted filesystem access to sel_ldr

src/trusted/service_runtime/nacl_syscall_common.h

Index: src/trusted/service_runtime/nacl_syscall_common.h
diff --git a/src/trusted/service_runtime/nacl_syscall_common.h b/src/trusted/service_runtime/nacl_syscall_common.h
index aacec8df69cdf3872699f71a43bd744c201448d0..ffb603c0fa77f97086d52791d49cd2fa123601b0 100644
--- a/src/trusted/service_runtime/nacl_syscall_common.h
+++ b/src/trusted/service_runtime/nacl_syscall_common.h
@@ -45,6 +45,24 @@ extern int NaClAclBypassChecks;
 
 void NaClInsecurelyBypassAllAclChecks(void);
 
+/*
+ * NaClRootDir will not be NULL when a root dir has been provided and NULL
+ * otherwise. NaClRootDir also never ends with a trailing slash.
+ * The upshot of the last two properties is that when NaClRootDir is set to
+ * "/" the value will be "" with length 0.
+ */
+extern char *NaClRootDir;
+extern size_t NaClRootDirLen;
+
+/* bool */
+int NaClMountRootDir(char *root);
+
+/* bool */
+int NaClFileAccessEnabled(void);
+
+/* bool */
+int NaClSanitizePathLexically(char *path);
+
 /* bool */
 int NaClSysCommonAddrRangeContainsExecutablePages(struct NaClApp *nap,
                                                   uintptr_t usraddr,