[reland] Remove SandboxBPF's dependency on CompatibilityPolicy

sandbox/linux/seccomp-bpf/demo.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/unistd.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 #include <pthread.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/ioctl.h>
 #include <sys/ipc.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
 #include <sys/shm.h>
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
+#include "base/macros.h"
 #include "base/posix/eintr_wrapper.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
+#include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 using sandbox::ErrorCode;
 using sandbox::SandboxBPF;
+using sandbox::SandboxBPFPolicy;
 using sandbox::arch_seccomp_data;
 
 #define ERR EPERM
 
 // We don't expect our sandbox to do anything useful yet. So, we will fail
 // almost immediately. For now, force the code to continue running. The
 // following line should be removed as soon as the sandbox is starting to
 // actually enforce restrictions in a meaningful way:
 #define _exit(x) do { } while (0)
 
@@ skipping 185 matching lines @@
 
   ptr = strrchr(ptr, '\000');
   strncat(ptr, msg1, sizeof(buf) - (ptr - buf));
 
   ptr = strrchr(ptr, '\000');
   if (HANDLE_EINTR(write(2, buf, ptr - buf))) { }
 
   return -ERR;
 }
 
-ErrorCode Evaluator(SandboxBPF* sandbox, int sysno, void *) {
+class DemoPolicy : public SandboxBPFPolicy {
+ public:
+  DemoPolicy() {}
+  virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox,
+                                    int sysno) const OVERRIDE;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DemoPolicy);
+};
+
+ErrorCode DemoPolicy::EvaluateSyscall(SandboxBPF* sandbox, int sysno) const {
   switch (sysno) {
 #if defined(__NR_accept)
   case __NR_accept: case __NR_accept4:
 #endif
   case __NR_alarm:
   case __NR_brk:
   case __NR_clock_gettime:
   case __NR_close:
   case __NR_dup: case __NR_dup2:
   case __NR_epoll_create: case __NR_epoll_ctl: case __NR_epoll_wait:
@@ skipping 162 matching lines @@
   if (argc) { }
   if (argv) { }
   int proc_fd = open("/proc", O_RDONLY|O_DIRECTORY);
   if (SandboxBPF::SupportsSeccompSandbox(proc_fd) !=
       SandboxBPF::STATUS_AVAILABLE) {
     perror("sandbox");
     _exit(1);
   }
   SandboxBPF sandbox;
   sandbox.set_proc_fd(proc_fd);
-  sandbox.SetSandboxPolicyDeprecated(Evaluator, NULL);
+  sandbox.SetSandboxPolicy(new DemoPolicy());
   if (!sandbox.StartSandbox(SandboxBPF::PROCESS_SINGLE_THREADED)) {
     fprintf(stderr, "StartSandbox() failed");
     _exit(1);
   }
 
   // Check that we can create threads
   pthread_t thr;
   if (!pthread_create(&thr, NULL, ThreadFnc,
                       reinterpret_cast<void *>(0x1234))) {
     void *ret;
@@ skipping 86 matching lines @@
       perror("pthread_create");
       _exit(1);
     }
   }
   for (int i = 0; i < kSendmsgStressNumThreads; ++i) {
     pthread_join(sendmsgStressThreads[i], NULL);
   }
 
   return 0;
 }