Add seccomp sandbox for non-SFI NaCl

components/nacl/loader/nacl_listener.cc

Index: components/nacl/loader/nacl_listener.cc
diff --git a/components/nacl/loader/nacl_listener.cc b/components/nacl/loader/nacl_listener.cc
index 60e8579008c494ea5fa0d5a4a9333f1973f28d5d..2f0d3fce2877db622df22c4b84e78b3b0ad2a576 100644
--- a/components/nacl/loader/nacl_listener.cc
+++ b/components/nacl/loader/nacl_listener.cc
@@ -268,7 +268,10 @@ void NaClListener::OnStart(const nacl::NaClStartParams& params) {
   NaClChromeMainSetUrandomFd(urandom_fd);
 #endif
 
-  NaClChromeMainInit();
+  if (params.uses_nonsfi_mode)
+    NaClChromeMainInitForNonSfi();

[Mark Seaborn, 2014/03/28 01:38:25]

AFAICT, this function isn't defined, so this change doesn't compile?  I don't
see any trybot results for this change.

However, it would be nice to clean up this function.  It would make sense to
refactor OnStart() so that it checks params.uses_nonsfi_mode right at the start
and only does the minimum required when running in Non-SFI Mode.

[hamaji, 2014/03/28 12:06:10]

Sorry, I forgot to publish this change
(https://codereview.chromium.org/209423004/) for review. As this changes the
native_client repository, I need to wait for the next NaCl roll until try bot
works, I think?

+  else
+    NaClChromeMainInit();
   struct NaClChromeMainArgs *args = NaClChromeMainArgsCreate();
   if (args == NULL) {
     LOG(ERROR) << "NaClChromeMainArgsCreate() failed";