Linux Sandbox: Add support for SECCOMP_RET_TRACE.

sandbox/linux/seccomp-bpf/errorcode_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <errno.h>
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/tests/unit_tests.h"
 
 namespace sandbox {
 
 namespace {
 
 SANDBOX_TEST(ErrorCode, ErrnoConstructor) {
   ErrorCode e0;
   SANDBOX_ASSERT(e0.err() == SECCOMP_RET_INVALID);
 
   ErrorCode e1(ErrorCode::ERR_ALLOWED);
   SANDBOX_ASSERT(e1.err() == SECCOMP_RET_ALLOW);
 
   ErrorCode e2(EPERM);
   SANDBOX_ASSERT(e2.err() == SECCOMP_RET_ERRNO + EPERM);
 
   SandboxBPF sandbox;
   ErrorCode e3 = sandbox.Trap(NULL, NULL);
   SANDBOX_ASSERT((e3.err() & SECCOMP_RET_ACTION)  == SECCOMP_RET_TRAP);
+
+  uint16_t data = 0xdead;
+  ErrorCode e4(ErrorCode::ERR_TRACE + data);
+  SANDBOX_ASSERT(e4.err() == SECCOMP_RET_TRACE + data);
 }
 

[jln (very slow on Chromium), 2014/05/20 03:02:10]

Could you add a death test if trying to use SECCOMP_RET_TRACE +
not_16_bits_value?

[rickyz (Google), 2014/05/20 22:34:01]

Done.

 SANDBOX_TEST(ErrorCode, Trap) {
   SandboxBPF sandbox;
   ErrorCode e0 = sandbox.Trap(NULL, "a");
   ErrorCode e1 = sandbox.Trap(NULL, "b");
   SANDBOX_ASSERT((e0.err() & SECCOMP_RET_DATA) + 1 ==
                  (e1.err() & SECCOMP_RET_DATA));
 
   ErrorCode e2 = sandbox.Trap(NULL, "a");
   SANDBOX_ASSERT((e0.err() & SECCOMP_RET_DATA) ==
                  (e2.err() & SECCOMP_RET_DATA));
@@ skipping 37 matching lines @@
   SANDBOX_ASSERT(e1.LessThan(e4));
   SANDBOX_ASSERT(e3.LessThan(e4));
   SANDBOX_ASSERT(e4.LessThan(e5));
   SANDBOX_ASSERT(!e4.LessThan(e6));
   SANDBOX_ASSERT(!e6.LessThan(e4));
 }
 
 }  // namespace
 
 }  // namespace sandbox