[MIPS] Add seccomp bpf support

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
index af3b3f1336aa5cc107766b1a6fb0cf7924df1178..73a9f25b9c706aa2d74f596555a381352b0d56cb 100644
--- a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
@@ -51,17 +51,17 @@ sandbox::ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
   switch (sysno) {
     // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
     // see if it can be restricted a bit.
-#if defined(__x86_64__) || defined(__arm__)
+#if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
     // transport_common.cc needs this.
     case __NR_accept:
     case __NR_setsockopt:
-#elif defined(__i386__)
+#elif defined(__i386__) || defined(__mips__)

[mdempsky, 2014/07/14 18:10:50]

Adding "|| defined(__mips__)" here doesn't really make sense, since this case
will be caught by the #if above.

Also, does MIPS really use socketcall()?  socketcall() passes all of its
arguments indirectly, so we can't filter it in seccomp-BPF.  If it actually
supports accept(), setsockopt(), etc., then it would be preferable to only allow
those I think.

[nedeljko, 2014/07/15 15:22:15]

Done.

     case __NR_socketcall:
 #endif
     // trusted/service_runtime/linux/thread_suspension.c needs sigwait() and is
     // used by NaCl's GDB debug stub.
     case __NR_rt_sigtimedwait:
-#if defined(__i386__)
+#if defined(__i386__) || defined(__mips__)
     // Needed on i386 to set-up the custom segments.
     case __NR_modify_ldt:
 #endif
@@ -70,7 +70,7 @@ sandbox::ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
     // NaCl uses custom signal stacks.
     case __NR_sigaltstack:
     // Below is fairly similar to the policy for a Chromium renderer.
-#if defined(__i386__) || defined(__x86_64__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
     case __NR_getrlimit:
 #endif
 #if defined(__i386__) || defined(__arm__)
@@ -120,9 +120,7 @@ void RunSandboxSanityChecks() {
 
 #else
 
-#if !defined(ARCH_CPU_MIPS_FAMILY)
 #error "Seccomp-bpf disabled on supported architecture!"
-#endif  // !defined(ARCH_CPU_MIPS_FAMILY)
 
 #endif  // defined(USE_SECCOMP_BPF)