Reland: Add seccomp sandbox for non-SFI NaCl

components/nacl.gyp

 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     'chromium_code': 1,
   },
   'includes': [
     'nacl/nacl_defines.gypi',
@@ skipping 125 matching lines @@
           'defines': [
             '<@(nacl_defines)',
           ],
           # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
           'msvs_disabled_warnings': [4267, ],
         },
         {
           'target_name': 'nacl_renderer',
           'type': 'static_library',
           'sources': [
             'nacl/renderer/manifest_service_channel.cc',

[hamaji, 2014/04/17 18:25:36]

Merged hidehiko@'s change.

             'nacl/renderer/manifest_service_channel.h',
             'nacl/renderer/nexe_load_manager.cc',
             'nacl/renderer/nexe_load_manager.h',
             'nacl/renderer/pnacl_translation_resource_host.cc',
             'nacl/renderer/pnacl_translation_resource_host.h',
             'nacl/renderer/ppb_nacl_private_impl.cc',
             'nacl/renderer/ppb_nacl_private_impl.h',
             'nacl/renderer/sandbox_arch.cc',
             'nacl/renderer/sandbox_arch.h',
             'nacl/renderer/trusted_plugin_channel.cc',
@@ skipping 27 matching lines @@
       ],
       'conditions': [
         ['OS=="linux"', {
           'targets': [
             {
               'target_name': 'nacl_helper',
               'type': 'executable',
               'include_dirs': [
                 '..',
               ],
+              'sources': [
+                'nacl/loader/nacl_helper_linux.cc',
+                'nacl/loader/nacl_helper_linux.h',
+              ],
               'dependencies': [
-                'nacl',
-                'nacl_common',
-                'nacl_switches',
-                '../components/tracing.gyp:tracing',
-                '../crypto/crypto.gyp:crypto',
-                '../sandbox/sandbox.gyp:libc_urandom_override',
-                '../sandbox/sandbox.gyp:sandbox',
-                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+                'nacl_loader',
               ],
+              'cflags': ['-fPIE'],
               'ldflags!': [
                 # Do not pick the default ASan options from
                 # base/debug/sanitizer_options.cc to avoid a conflict with those
                 # in nacl/nacl_helper_linux.cc.
                 '-Wl,-u_sanitizer_options_link_helper',
               ],
+              'link_settings': {
+                'ldflags': ['-pie'],
+              },
+            }, {
+              'target_name': 'nacl_loader',
+              'type': 'static_library',
+              'include_dirs': [
+                '..',
+              ],
               'defines': [
                 '<@(nacl_defines)',
                 # Allow .cc files to know if they're being compiled as part
                 # of nacl_helper.
                 'IN_NACL_HELPER=1',
               ],
               'sources': [
-                'nacl/loader/nacl_helper_linux.cc',
-                'nacl/loader/nacl_helper_linux.h',
                 'nacl/loader/nacl_sandbox_linux.cc',
                 'nacl/loader/nonsfi/abi_conversion.cc',
                 'nacl/loader/nonsfi/abi_conversion.h',
                 'nacl/loader/nonsfi/elf_loader.cc',
                 'nacl/loader/nonsfi/elf_loader.h',
                 'nacl/loader/nonsfi/irt_basic.cc',
                 'nacl/loader/nonsfi/irt_clock.cc',
                 'nacl/loader/nonsfi/irt_fdio.cc',
                 'nacl/loader/nonsfi/irt_futex.cc',
                 'nacl/loader/nonsfi/irt_interfaces.cc',
                 'nacl/loader/nonsfi/irt_interfaces.h',
                 'nacl/loader/nonsfi/irt_memory.cc',
                 'nacl/loader/nonsfi/irt_ppapi.cc',
                 'nacl/loader/nonsfi/irt_random.cc',
                 'nacl/loader/nonsfi/irt_thread.cc',
                 'nacl/loader/nonsfi/irt_util.h',
                 'nacl/loader/nonsfi/nonsfi_main.cc',
                 'nacl/loader/nonsfi/nonsfi_main.h',
+                'nacl/loader/nonsfi/nonsfi_sandbox.cc',
+                'nacl/loader/nonsfi/nonsfi_sandbox.h',
                 '../ppapi/nacl_irt/manifest_service.cc',
                 '../ppapi/nacl_irt/manifest_service.h',
                 '../ppapi/nacl_irt/plugin_main.cc',
                 '../ppapi/nacl_irt/plugin_main.h',
                 '../ppapi/nacl_irt/plugin_startup.cc',
                 '../ppapi/nacl_irt/plugin_startup.h',
                 '../ppapi/nacl_irt/ppapi_dispatcher.cc',
                 '../ppapi/nacl_irt/ppapi_dispatcher.h',
               ],
+              'dependencies': [
+                'nacl',
+                'nacl_common',
+                'nacl_switches',
+                '../components/tracing.gyp:tracing',
+                '../crypto/crypto.gyp:crypto',
+                '../sandbox/sandbox.gyp:libc_urandom_override',
+                '../sandbox/sandbox.gyp:sandbox',
+                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+              ],
               'conditions': [
                 ['toolkit_uses_gtk == 1', {
                   'dependencies': [
                     '../build/linux/system.gyp:gtk',
                   ],
                 }],
                 ['use_glib == 1', {
                   'dependencies': [
                     '../build/linux/system.gyp:glib',
                   ],
@@ skipping 11 matching lines @@
                 ['use_seccomp_bpf == 0', {
                   'sources!': [
                     '../content/common/sandbox_linux/sandbox_bpf_base_policy_linux.cc',
                     '../content/common/sandbox_linux/sandbox_init_linux.cc',
                   ],
                 }, {
                   'defines': ['USE_SECCOMP_BPF'],
                 }],
               ],
               'cflags': ['-fPIE'],
-              'link_settings': {
-                'ldflags': ['-pie'],
-              },
             },
           ],
         }],
         ['OS=="win" and target_arch=="ia32"', {
           'targets': [
             {
               'target_name': 'nacl_win64',
               'type': 'static_library',
               'variables': {
                 'nacl_target': 1,
@@ skipping 131 matching lines @@
       ],
       'include_dirs': [
         '..',
       ],
       'dependencies': [
         '../content/content.gyp:content_common',
       ],
     },
   ]
 }