Add seccomp sandbox for non-SFI NaCl

components/nacl/loader/nonsfi/elf_loader.cc

Index: components/nacl/loader/nonsfi/elf_loader.cc
diff --git a/components/nacl/loader/nonsfi/elf_loader.cc b/components/nacl/loader/nonsfi/elf_loader.cc
index c62117b459810672acbe5acd743204afa0128b77..cb1334e40b9e00a1899610c6632a967ea8eb19c0 100644
--- a/components/nacl/loader/nonsfi/elf_loader.cc
+++ b/components/nacl/loader/nonsfi/elf_loader.cc
@@ -270,8 +270,8 @@ NaClErrorCode ElfImage::Read(struct NaClDesc* descriptor) {
   ::scoped_ptr<Data> data(new Data);
 
   // Read elf header.
-  ssize_t read_ret = (*NACL_VTBL(NaClDesc, descriptor)->PRead)(
-      descriptor, &data->ehdr, sizeof(data->ehdr), 0);
+  ssize_t read_ret = (*NACL_VTBL(NaClDesc, descriptor)->Read)(
+      descriptor, &data->ehdr, sizeof(data->ehdr));
   if (NaClSSizeIsNegErrno(&read_ret) ||
       static_cast<size_t>(read_ret) != sizeof(data->ehdr)) {
     LOG(ERROR) << "Could not load elf headers.";
@@ -295,9 +295,18 @@ NaClErrorCode ElfImage::Read(struct NaClDesc* descriptor) {
     return LOAD_BAD_PHENTSIZE;
   }
 
+  // We avoid the use of pread here to reduce the number of required
+  // syscalls for non-SFI mode.
+  off_t ret = (*NACL_VTBL(NaClDesc, descriptor)->Seek)(
+      descriptor, data->ehdr.e_phoff, SEEK_SET);
+  if (ret != static_cast<off_t>(data->ehdr.e_phoff)) {
+    LOG(ERROR) << "Cannot load prog headers";
+    return LOAD_READ_ERROR;
+  }
+
   size_t read_size = data->ehdr.e_phnum * data->ehdr.e_phentsize;
-  read_ret = (*NACL_VTBL(NaClDesc, descriptor)->PRead)(
-      descriptor, data->phdrs, read_size, data->ehdr.e_phoff);
+  read_ret = (*NACL_VTBL(NaClDesc, descriptor)->Read)(
+      descriptor, data->phdrs, read_size);
 
   if (NaClSSizeIsNegErrno(&read_ret) ||
       static_cast<size_t>(read_ret) != read_size) {