sandbox/linux: refactor bpf_dsl dependency on die.h

sandbox/linux/bpf_dsl/policy_compiler.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_BPF_DSL_POLICY_COMPILER_H_
 #define SANDBOX_LINUX_BPF_DSL_POLICY_COMPILER_H_
 
 #include <stdint.h>
 
 #include <map>
 #include <set>
 #include <vector>
 
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
 #include "sandbox/linux/bpf_dsl/codegen.h"
+#include "sandbox/linux/bpf_dsl/trap_registry.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 #include "sandbox/sandbox_export.h"
 
 namespace sandbox {
 namespace bpf_dsl {
 class Policy;
 
 // PolicyCompiler implements the bpf_dsl compiler, allowing users to
 // transform bpf_dsl policies into BPF programs to be executed by the
 // Linux kernel.
 class SANDBOX_EXPORT PolicyCompiler {
  public:
+  using PanicFunc = bpf_dsl::ResultExpr (*)(const char* error);
+
   PolicyCompiler(const Policy* policy, TrapRegistry* registry);
   ~PolicyCompiler();
 
   // Compile registers any trap handlers needed by the policy and
   // compiles the policy to a BPF program, which it returns.
   scoped_ptr<CodeGen::Program> Compile(bool verify);
 
   // DangerousSetEscapePC sets the "escape PC" that is allowed to issue any
   // system calls, regardless of policy.
   void DangerousSetEscapePC(uint64_t escapepc);
 
+  // SetPanicFunc sets the callback function used for handling faulty
+  // system call conditions.  The default behavior is to immediately kill
+  // the process.
+  // TODO(mdempsky): Move this into Policy?
+  void SetPanicFunc(PanicFunc panic_func);
+
   // Error returns an ErrorCode to indicate the system call should fail with
   // the specified error number.
   ErrorCode Error(int err);
 
   // Trap returns an ErrorCode to indicate the system call should
   // instead invoke a trap handler.
   ErrorCode Trap(TrapRegistry::TrapFnc fnc, const void* aux, bool safe);
 
   // UnsafeTraps require some syscalls to always be allowed.
   // This helper function returns true for these calls.
@@ skipping 87 matching lines @@
   // Returns a BPF program that evaluates half of a conditional expression;
   // it should only ever be called from CondExpression().
   CodeGen::Node CondExpressionHalf(const ErrorCode& cond,
                                    ArgHalf half,
                                    CodeGen::Node passed,
                                    CodeGen::Node failed);
 
   const Policy* policy_;
   TrapRegistry* registry_;
   uint64_t escapepc_;
+  PanicFunc panic_func_;
 
   Conds conds_;
   CodeGen gen_;
   bool has_unsafe_traps_;
 
   DISALLOW_COPY_AND_ASSIGN(PolicyCompiler);
 };
 
 }  // namespace bpf_dsl
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_BPF_DSL_POLICY_COMPILER_H_