Add seccomp sandbox for non-SFI NaCl

components/nacl.gyp

 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     'chromium_code': 1,
   },
   'includes': [
     'nacl/nacl_defines.gypi',
@@ skipping 163 matching lines @@
       ],
       'conditions': [
         ['OS=="linux"', {
           'targets': [
             {
               'target_name': 'nacl_helper',
               'type': 'executable',
               'include_dirs': [
                 '..',
               ],
+              'sources': [
+                'nacl/loader/nacl_helper_linux.cc',
+                'nacl/loader/nacl_helper_linux.h',
+              ],
               'dependencies': [
-                'nacl',
-                'nacl_common',
-                'nacl_switches',
-                '../components/tracing.gyp:tracing',
-                '../crypto/crypto.gyp:crypto',
-                '../sandbox/sandbox.gyp:libc_urandom_override',
-                '../sandbox/sandbox.gyp:sandbox',
-                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+                'nacl_loader',
+              ],
+              'cflags': ['-fPIE'],
+              'link_settings': {
+                'ldflags': ['-pie'],
+              },
+            }, {
+              'target_name': 'nacl_loader',
+              'type': 'static_library',
+              'include_dirs': [
+                '..',
               ],
               'defines': [
                 '<@(nacl_defines)',
                 # Allow .cc files to know if they're being compiled as part
                 # of nacl_helper.
                 'IN_NACL_HELPER=1',
               ],
               'sources': [
-                'nacl/loader/nacl_helper_linux.cc',
-                'nacl/loader/nacl_helper_linux.h',
                 'nacl/loader/nacl_sandbox_linux.cc',
                 'nacl/loader/nonsfi/abi_conversion.cc',
                 'nacl/loader/nonsfi/abi_conversion.h',
                 'nacl/loader/nonsfi/elf_loader.cc',
                 'nacl/loader/nonsfi/elf_loader.h',
                 'nacl/loader/nonsfi/irt_basic.cc',
                 'nacl/loader/nonsfi/irt_clock.cc',
                 'nacl/loader/nonsfi/irt_fdio.cc',
                 'nacl/loader/nonsfi/irt_futex.cc',
                 'nacl/loader/nonsfi/irt_interfaces.cc',
                 'nacl/loader/nonsfi/irt_interfaces.h',
                 'nacl/loader/nonsfi/irt_memory.cc',
                 'nacl/loader/nonsfi/irt_ppapi.cc',
                 'nacl/loader/nonsfi/irt_random.cc',
                 'nacl/loader/nonsfi/irt_thread.cc',
                 'nacl/loader/nonsfi/irt_util.h',
                 'nacl/loader/nonsfi/nonsfi_main.cc',
                 'nacl/loader/nonsfi/nonsfi_main.h',
+                'nacl/loader/nonsfi/nonsfi_sandbox.cc',
+                'nacl/loader/nonsfi/nonsfi_sandbox.h',
                 '../ppapi/nacl_irt/plugin_main.cc',
                 '../ppapi/nacl_irt/plugin_main.h',
                 '../ppapi/nacl_irt/plugin_startup.cc',
                 '../ppapi/nacl_irt/plugin_startup.h',
                 '../ppapi/nacl_irt/ppapi_dispatcher.cc',
                 '../ppapi/nacl_irt/ppapi_dispatcher.h',
               ],
+              'dependencies': [
+                'nacl',
+                'nacl_common',
+                'nacl_switches',
+                '../components/tracing.gyp:tracing',
+                '../crypto/crypto.gyp:crypto',
+                '../sandbox/sandbox.gyp:libc_urandom_override',
+                '../sandbox/sandbox.gyp:sandbox',
+                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+              ],
               'conditions': [
                 ['toolkit_uses_gtk == 1', {
                   'dependencies': [
                     '../build/linux/system.gyp:gtk',
                   ],
                 }],
                 ['use_glib == 1', {
                   'dependencies': [
                     '../build/linux/system.gyp:glib',
                   ],
@@ skipping 12 matching lines @@
                   'sources!': [
                     '../content/common/sandbox_linux/sandbox_bpf_base_policy_linux.cc',
                     '../content/common/sandbox_linux/sandbox_init_linux.cc',
                   ],
                 }, {
                   'defines': ['USE_SECCOMP_BPF'],
                 }],
               ],
               'cflags': ['-fPIE'],
               'link_settings': {
                 'ldflags': ['-pie'],

[Mark Seaborn, 2014/04/15 23:03:14]

This doesn't make sense for a library, so you can remove it.

[hamaji, 2014/04/16 02:10:48]

Oops, done.

               },
             },
           ],
         }],
         ['OS=="win" and target_arch=="ia32"', {
           'targets': [
             {
               'target_name': 'nacl_win64',
               'type': 'static_library',
               'variables': {
@@ skipping 132 matching lines @@
       ],
       'include_dirs': [
         '..',
       ],
       'dependencies': [
         '../content/content.gyp:content_common',
       ],
     },
   ]
 }