Reland: Add seccomp sandbox for non-SFI NaCl

components/nacl.gyp

Index: components/nacl.gyp
diff --git a/components/nacl.gyp b/components/nacl.gyp
index ccf9db431c203da151e3ff941f57a80dd30ae1e5..c657034afc05aa4719bb8bbc5d5ed751ef64cb02 100644
--- a/components/nacl.gyp
+++ b/components/nacl.gyp
@@ -189,22 +189,29 @@
               'include_dirs': [
                 '..',
               ],
+              'sources': [
+                'nacl/loader/nacl_helper_linux.cc',
+                'nacl/loader/nacl_helper_linux.h',
+              ],
               'dependencies': [
-                'nacl',
-                'nacl_common',
-                'nacl_switches',
-                '../components/tracing.gyp:tracing',
-                '../crypto/crypto.gyp:crypto',
-                '../sandbox/sandbox.gyp:libc_urandom_override',
-                '../sandbox/sandbox.gyp:sandbox',
-                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+                'nacl_loader',
               ],
+              'cflags': ['-fPIE'],
               'ldflags!': [
                 # Do not pick the default ASan options from
                 # base/debug/sanitizer_options.cc to avoid a conflict with those
                 # in nacl/nacl_helper_linux.cc.
                 '-Wl,-u_sanitizer_options_link_helper',
               ],
+              'link_settings': {
+                'ldflags': ['-pie'],
+              },
+            }, {
+              'target_name': 'nacl_loader',
+              'type': 'static_library',
+              'include_dirs': [
+                '..',
+              ],
               'defines': [
                 '<@(nacl_defines)',
                 # Allow .cc files to know if they're being compiled as part
@@ -212,8 +219,6 @@
                 'IN_NACL_HELPER=1',
               ],
               'sources': [
-                'nacl/loader/nacl_helper_linux.cc',
-                'nacl/loader/nacl_helper_linux.h',
                 'nacl/loader/nacl_sandbox_linux.cc',
                 'nacl/loader/nonsfi/abi_conversion.cc',
                 'nacl/loader/nonsfi/abi_conversion.h',
@@ -232,6 +237,8 @@
                 'nacl/loader/nonsfi/irt_util.h',
                 'nacl/loader/nonsfi/nonsfi_main.cc',
                 'nacl/loader/nonsfi/nonsfi_main.h',
+                'nacl/loader/nonsfi/nonsfi_sandbox.cc',
+                'nacl/loader/nonsfi/nonsfi_sandbox.h',
                 '../ppapi/nacl_irt/plugin_main.cc',
                 '../ppapi/nacl_irt/plugin_main.h',
                 '../ppapi/nacl_irt/plugin_startup.cc',
@@ -239,6 +246,16 @@
                 '../ppapi/nacl_irt/ppapi_dispatcher.cc',
                 '../ppapi/nacl_irt/ppapi_dispatcher.h',
               ],
+              'dependencies': [
+                'nacl',
+                'nacl_common',
+                'nacl_switches',
+                '../components/tracing.gyp:tracing',
+                '../crypto/crypto.gyp:crypto',
+                '../sandbox/sandbox.gyp:libc_urandom_override',
+                '../sandbox/sandbox.gyp:sandbox',
+                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+              ],
               'conditions': [
                 ['toolkit_uses_gtk == 1', {
                   'dependencies': [
@@ -270,9 +287,6 @@
                 }],
               ],
               'cflags': ['-fPIE'],
-              'link_settings': {
-                'ldflags': ['-pie'],
-              },
             },
           ],
         }],