Build nacl_helper_nonsfi with GN

sandbox/linux/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/features.gni")
+import("//build/config/nacl/config.gni")
 import("//testing/test.gni")
 
 declare_args() {
   compile_suid_client = is_linux
 
   compile_credentials = is_linux
 
   # On Android, use plain GTest.
   use_base_test_suite = is_linux
 }
 
+if (is_nacl_nonsfi) {
+  config("nacl_nonsfi_warnings") {
+    # There are number of platform specific functions in
+    # seccomp-bpf syscall helpers, which are not being used.
+    cflags = [ "-Wno-unused-function" ]
+  }
+}
+
 # We have two principal targets: sandbox and sandbox_linux_unittests
 # All other targets are listed as dependencies.
 # There is one notable exception: for historical reasons, chrome_sandbox is
 # the setuid sandbox and is its own target.
 
 group("sandbox") {
   deps = [
     ":sandbox_services",
   ]
 
-  if (compile_suid_client) {
+  if (compile_suid_client || is_nacl_nonsfi) {
     deps += [ ":suid_sandbox_client" ]
   }
-  if (use_seccomp_bpf) {
+  if (use_seccomp_bpf || is_nacl_nonsfi) {
     deps += [
       ":seccomp_bpf",
       ":seccomp_bpf_helpers",
     ]
   }
 }
 
 source_set("sandbox_linux_test_utils") {
   testonly = true
   sources = [
@@ skipping 195 matching lines @@
     "seccomp-bpf/trap.cc",
     "seccomp-bpf/trap.h",
   ]
   defines = [ "SANDBOX_IMPLEMENTATION" ]
 
   deps = [
     ":sandbox_services",
     ":sandbox_services_headers",
     "//base",
   ]
+
+  if (is_nacl_nonsfi) {
+    cflags = [ "-fgnu-inline-asm" ]
+    sources -= [
+      "bpf_dsl/bpf_dsl_forward.h",
+      "bpf_dsl/bpf_dsl_impl.h",
+      "bpf_dsl/cons.h",
+      "bpf_dsl/errorcode.h",
+      "bpf_dsl/linux_syscall_ranges.h",
+      "bpf_dsl/seccomp_macros.h",
+      "bpf_dsl/trap_registry.h",
+    ]
+  }
 }
 
 component("seccomp_bpf_helpers") {
   sources = [
     "seccomp-bpf-helpers/baseline_policy.cc",
     "seccomp-bpf-helpers/baseline_policy.h",
     "seccomp-bpf-helpers/sigsys_handlers.cc",
     "seccomp-bpf-helpers/sigsys_handlers.h",
     "seccomp-bpf-helpers/syscall_parameters_restrictions.cc",
     "seccomp-bpf-helpers/syscall_parameters_restrictions.h",
     "seccomp-bpf-helpers/syscall_sets.cc",
     "seccomp-bpf-helpers/syscall_sets.h",
   ]
   defines = [ "SANDBOX_IMPLEMENTATION" ]
 
   deps = [
     "//base",
     ":sandbox_services",
     ":seccomp_bpf",
   ]
+
+  if (is_nacl_nonsfi) {
+    sources -= [
+      "seccomp-bpf-helpers/baseline_policy.cc",
+      "seccomp-bpf-helpers/baseline_policy.h",
+      "seccomp-bpf-helpers/syscall_sets.cc",
+      "seccomp-bpf-helpers/syscall_sets.h",
+    ]
+    configs += [ ":nacl_nonsfi_warnings" ]
+  }
 }
 
 if (is_linux) {
   # The setuid sandbox for Linux.
   executable("chrome_sandbox") {
     sources = [
       "suid/common/sandbox.h",
       "suid/common/suid_unsafe_environment_variables.h",
       "suid/process_util.h",
       "suid/process_util_linux.c",
@@ skipping 45 matching lines @@
     "syscall_broker/broker_process.cc",
     "syscall_broker/broker_process.h",
   ]
 
   defines = [ "SANDBOX_IMPLEMENTATION" ]
 
   deps = [
     "//base",
   ]
 
-  if (compile_credentials) {
+  if (compile_credentials || is_nacl_nonsfi) {
     sources += [
       "services/credentials.cc",
       "services/credentials.h",
       "services/namespace_sandbox.cc",
       "services/namespace_sandbox.h",
       "services/namespace_utils.cc",
       "services/namespace_utils.h",
     ]
 
     deps += [ ":sandbox_services_headers" ]
   }
+
+  if (is_nacl_nonsfi) {
+    sources -= [
+      "services/init_process_reaper.cc",
+      "services/init_process_reaper.h",
+      "services/scoped_process.cc",
+      "services/scoped_process.h",
+      "services/yama.cc",
+      "services/yama.h",
+      "syscall_broker/broker_channel.cc",
+      "syscall_broker/broker_channel.h",
+      "syscall_broker/broker_client.cc",
+      "syscall_broker/broker_client.h",
+      "syscall_broker/broker_common.h",
+      "syscall_broker/broker_file_permission.cc",
+      "syscall_broker/broker_file_permission.h",
+      "syscall_broker/broker_host.cc",
+      "syscall_broker/broker_host.h",
+      "syscall_broker/broker_policy.cc",
+      "syscall_broker/broker_policy.h",
+      "syscall_broker/broker_process.cc",
+      "syscall_broker/broker_process.h",
+    ]
+  }
 }
 
 source_set("sandbox_services_headers") {
   sources = [
     "system_headers/arm64_linux_syscalls.h",
     "system_headers/arm64_linux_ucontext.h",
     "system_headers/arm_linux_syscalls.h",
     "system_headers/arm_linux_ucontext.h",
     "system_headers/i386_linux_ucontext.h",
     "system_headers/linux_futex.h",
     "system_headers/linux_seccomp.h",
     "system_headers/linux_signal.h",
     "system_headers/linux_syscalls.h",
     "system_headers/linux_time.h",
     "system_headers/linux_ucontext.h",
     "system_headers/x86_32_linux_syscalls.h",
     "system_headers/x86_64_linux_syscalls.h",
   ]
 }
 
-if (compile_suid_client) {
+if (compile_suid_client || is_nacl_nonsfi) {
   component("suid_sandbox_client") {
     sources = [
       "suid/client/setuid_sandbox_client.cc",
       "suid/client/setuid_sandbox_client.h",
       "suid/client/setuid_sandbox_host.cc",
       "suid/client/setuid_sandbox_host.h",
       "suid/common/sandbox.h",
       "suid/common/suid_unsafe_environment_variables.h",
     ]
     defines = [ "SANDBOX_IMPLEMENTATION" ]
 
     deps = [
       ":sandbox_services",
       "//base",
     ]
+
+    if (is_nacl_nonsfi) {
+      sources -= [
+        "suid/client/setuid_sandbox_host.cc",
+        "suid/client/setuid_sandbox_host.h",
+        "suid/common/sandbox.h",
+        "suid/common/suid_unsafe_environment_variables.h",
+      ]
+    }
   }
 }
 
 if (is_android) {
   # TODO(GYP) enable this. Needs an android_strip wrapper python script.
   #action("sandbox_linux_unittests_stripped") {
   #  script = "android_stip.py"
   #
   #  in_file = "$root_out_dir/sandbox_linux_unittests"
   #
@@ skipping 15 matching lines @@
   #      'type': 'none',
   #      'variables': {
   #        'test_suite_name': 'sandbox_linux_jni_unittests',
   #      },
   #      'dependencies': [
   #        'sandbox_linux_jni_unittests',
   #      ],
   #      'includes': [ '../../build/apk_test.gypi' ],
   #      }
 }