Reland: Add seccomp sandbox for non-SFI NaCl

components/nacl.gyp

Index: components/nacl.gyp
diff --git a/components/nacl.gyp b/components/nacl.gyp
index dd23775914a4a31fc84f11d14818512744a658e1..68fbb7a0bab00a7d037c2f9688b115db7b7f2ab0 100644
--- a/components/nacl.gyp
+++ b/components/nacl.gyp
@@ -191,22 +191,29 @@
               'include_dirs': [
                 '..',
               ],
+              'sources': [
+                'nacl/loader/nacl_helper_linux.cc',
+                'nacl/loader/nacl_helper_linux.h',
+              ],
               'dependencies': [
-                'nacl',
-                'nacl_common',
-                'nacl_switches',
-                '../components/tracing.gyp:tracing',
-                '../crypto/crypto.gyp:crypto',
-                '../sandbox/sandbox.gyp:libc_urandom_override',
-                '../sandbox/sandbox.gyp:sandbox',
-                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+                'nacl_loader',
               ],
+              'cflags': ['-fPIE'],
               'ldflags!': [
                 # Do not pick the default ASan options from
                 # base/debug/sanitizer_options.cc to avoid a conflict with those
                 # in nacl/nacl_helper_linux.cc.
                 '-Wl,-u_sanitizer_options_link_helper',
               ],
+              'link_settings': {
+                'ldflags': ['-pie'],
+              },
+            }, {
+              'target_name': 'nacl_loader',
+              'type': 'static_library',
+              'include_dirs': [
+                '..',
+              ],
               'defines': [
                 '<@(nacl_defines)',
                 # Allow .cc files to know if they're being compiled as part
@@ -214,8 +221,6 @@
                 'IN_NACL_HELPER=1',
               ],
               'sources': [
-                'nacl/loader/nacl_helper_linux.cc',
-                'nacl/loader/nacl_helper_linux.h',
                 'nacl/loader/nacl_sandbox_linux.cc',
                 'nacl/loader/nonsfi/abi_conversion.cc',
                 'nacl/loader/nonsfi/abi_conversion.h',
@@ -234,6 +239,8 @@
                 'nacl/loader/nonsfi/irt_util.h',
                 'nacl/loader/nonsfi/nonsfi_main.cc',
                 'nacl/loader/nonsfi/nonsfi_main.h',
+                'nacl/loader/nonsfi/nonsfi_sandbox.cc',
+                'nacl/loader/nonsfi/nonsfi_sandbox.h',
                 '../ppapi/nacl_irt/manifest_service.cc',
                 '../ppapi/nacl_irt/manifest_service.h',
                 '../ppapi/nacl_irt/plugin_main.cc',
@@ -243,6 +250,16 @@
                 '../ppapi/nacl_irt/ppapi_dispatcher.cc',
                 '../ppapi/nacl_irt/ppapi_dispatcher.h',
               ],
+              'dependencies': [
+                'nacl',
+                'nacl_common',
+                'nacl_switches',
+                '../components/tracing.gyp:tracing',
+                '../crypto/crypto.gyp:crypto',
+                '../sandbox/sandbox.gyp:libc_urandom_override',
+                '../sandbox/sandbox.gyp:sandbox',
+                '../ppapi/ppapi_internal.gyp:ppapi_proxy',
+              ],
               'conditions': [
                 ['toolkit_uses_gtk == 1', {
                   'dependencies': [
@@ -274,9 +291,6 @@
                 }],
               ],
               'cflags': ['-fPIE'],
-              'link_settings': {
-                'ldflags': ['-pie'],
-              },
             },
           ],
         }],