Revert of Remove SandboxBPF's dependency on CompatibilityPolicy

sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <errno.h>
 #include <pthread.h>
 #include <sched.h>
 #include <sys/prctl.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/utsname.h>
 #include <unistd.h>
 
 #if defined(ANDROID)
 // Work-around for buggy headers in Android's NDK
 #define __user
 #endif
 #include <linux/futex.h>
 
 #include <ostream>
 
 #include "base/bind.h"
 #include "base/logging.h"
-#include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "build/build_config.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
 #include "sandbox/linux/seccomp-bpf/syscall.h"
 #include "sandbox/linux/seccomp-bpf/trap.h"
 #include "sandbox/linux/seccomp-bpf/verifier.h"
 #include "sandbox/linux/services/broker_process.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 #include "sandbox/linux/tests/unit_tests.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ skipping 42 matching lines @@
 // and it helps us accidentally forgetting any of the crucial steps in
 // setting up the sandbox. But it wouldn't hurt to have at least one test
 // that explicitly walks through all these steps.
 
 intptr_t FakeGetPid(const struct arch_seccomp_data& args, void* aux) {
   BPF_ASSERT(aux);
   pid_t* pid_ptr = static_cast<pid_t*>(aux);
   return (*pid_ptr)++;
 }
 
-class VerboseAPITestingPolicy : public SandboxBPFPolicy {
- public:
-  VerboseAPITestingPolicy(pid_t* pid_ptr) : pid_ptr_(pid_ptr) {}
-
-  virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox,
-                                    int sysno) const OVERRIDE {
-    DCHECK(SandboxBPF::IsValidSyscallNumber(sysno));
-    if (sysno == __NR_getpid) {
-      return sandbox->Trap(FakeGetPid, pid_ptr_);
-    }
+ErrorCode VerboseAPITestingPolicy(SandboxBPF* sandbox, int sysno, void* aux) {
+  if (!SandboxBPF::IsValidSyscallNumber(sysno)) {
+    return ErrorCode(ENOSYS);
+  } else if (sysno == __NR_getpid) {
+    return sandbox->Trap(FakeGetPid, aux);
+  } else {
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
-
- private:
-  pid_t* pid_ptr_;
-  DISALLOW_COPY_AND_ASSIGN(VerboseAPITestingPolicy);
-};
+}
 
 SANDBOX_TEST(SandboxBPF, DISABLE_ON_TSAN(VerboseAPITesting)) {
   if (SandboxBPF::SupportsSeccompSandbox(-1) ==
       sandbox::SandboxBPF::STATUS_AVAILABLE) {
-    pid_t pid;
-
+    pid_t test_var = 0;
     SandboxBPF sandbox;
-    sandbox.SetSandboxPolicy(new VerboseAPITestingPolicy(&pid));
+    sandbox.SetSandboxPolicyDeprecated(VerboseAPITestingPolicy, &test_var);
     BPF_ASSERT(sandbox.StartSandbox(SandboxBPF::PROCESS_SINGLE_THREADED));
 
-    BPF_ASSERT_EQ(0, pid);
-    BPF_ASSERT_EQ(0, syscall(__NR_getpid));
-    BPF_ASSERT_EQ(1, pid);
-    BPF_ASSERT_EQ(1, syscall(__NR_getpid));
-    BPF_ASSERT_EQ(2, pid);
+    BPF_ASSERT(test_var == 0);
+    BPF_ASSERT(syscall(__NR_getpid) == 0);
+    BPF_ASSERT(test_var == 1);
+    BPF_ASSERT(syscall(__NR_getpid) == 1);
+    BPF_ASSERT(test_var == 2);
 
     // N.B.: Any future call to getpid() would corrupt the stack.
     //       This is OK. The SANDBOX_TEST() macro is guaranteed to
     //       only ever call _exit() after the test completes.
   }
 }
 
 // A simple blacklist test
 
 ErrorCode BlacklistNanosleepPolicy(SandboxBPF*, int sysno, void* aux) {
@@ skipping 157 matching lines @@
 
   // Finally, test an errno in between the minimum and maximum.
   errno = 0;
   struct utsname uts_buf;
   BPF_ASSERT(uname(&uts_buf) == -1);
   BPF_ASSERT(errno == 42);
 }
 
 // Testing the stacking of two sandboxes
 
-class StackingPolicyPartOne : public SandboxBPFPolicy {
- public:
-  StackingPolicyPartOne() {}
-  virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox,
-                                    int sysno) const OVERRIDE {
-    DCHECK(SandboxBPF::IsValidSyscallNumber(sysno));
-    switch (sysno) {
-      case __NR_getppid:
-        return sandbox->Cond(0,
-                             ErrorCode::TP_32BIT,
-                             ErrorCode::OP_EQUAL,
-                             0,
-                             ErrorCode(ErrorCode::ERR_ALLOWED),
-                             ErrorCode(EPERM));
-      default:
-        return ErrorCode(ErrorCode::ERR_ALLOWED);
-    }
+ErrorCode StackingPolicyPartOne(SandboxBPF* sandbox, int sysno, void*) {
+  if (!SandboxBPF::IsValidSyscallNumber(sysno)) {
+    return ErrorCode(ENOSYS);
   }
 
- private:
-  DISALLOW_COPY_AND_ASSIGN(StackingPolicyPartOne);
-};
+  switch (sysno) {
+    case __NR_getppid:
+      return sandbox->Cond(0,
+                           ErrorCode::TP_32BIT,
+                           ErrorCode::OP_EQUAL,
+                           0,
+                           ErrorCode(ErrorCode::ERR_ALLOWED),
+                           ErrorCode(EPERM));
+    default:
+      return ErrorCode(ErrorCode::ERR_ALLOWED);
+  }
+}
 
-class StackingPolicyPartTwo : public SandboxBPFPolicy {
- public:
-  StackingPolicyPartTwo() {}
-  virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox,
-                                    int sysno) const OVERRIDE {
-    DCHECK(SandboxBPF::IsValidSyscallNumber(sysno));
-    switch (sysno) {
-      case __NR_getppid:
-        return sandbox->Cond(0,
-                             ErrorCode::TP_32BIT,
-                             ErrorCode::OP_EQUAL,
-                             0,
-                             ErrorCode(EINVAL),
-                             ErrorCode(ErrorCode::ERR_ALLOWED));
-      default:
-        return ErrorCode(ErrorCode::ERR_ALLOWED);
-    }
+ErrorCode StackingPolicyPartTwo(SandboxBPF* sandbox, int sysno, void*) {
+  if (!SandboxBPF::IsValidSyscallNumber(sysno)) {
+    return ErrorCode(ENOSYS);
   }
 
- private:
-  DISALLOW_COPY_AND_ASSIGN(StackingPolicyPartTwo);
-};
+  switch (sysno) {
+    case __NR_getppid:
+      return sandbox->Cond(0,
+                           ErrorCode::TP_32BIT,
+                           ErrorCode::OP_EQUAL,
+                           0,
+                           ErrorCode(EINVAL),
+                           ErrorCode(ErrorCode::ERR_ALLOWED));
+    default:
+      return ErrorCode(ErrorCode::ERR_ALLOWED);
+  }
+}
 
-BPF_TEST_C(SandboxBPF, StackingPolicy, StackingPolicyPartOne) {
+BPF_TEST(SandboxBPF, StackingPolicy, StackingPolicyPartOne) {
   errno = 0;
   BPF_ASSERT(syscall(__NR_getppid, 0) > 0);
   BPF_ASSERT(errno == 0);
 
   BPF_ASSERT(syscall(__NR_getppid, 1) == -1);
   BPF_ASSERT(errno == EPERM);
 
   // Stack a second sandbox with its own policy. Verify that we can further
   // restrict filters, but we cannot relax existing filters.
   SandboxBPF sandbox;
-  sandbox.SetSandboxPolicy(new StackingPolicyPartTwo());
+  sandbox.SetSandboxPolicyDeprecated(StackingPolicyPartTwo, NULL);
   BPF_ASSERT(sandbox.StartSandbox(SandboxBPF::PROCESS_SINGLE_THREADED));
 
   errno = 0;
   BPF_ASSERT(syscall(__NR_getppid, 0) == -1);
   BPF_ASSERT(errno == EINVAL);
 
   BPF_ASSERT(syscall(__NR_getppid, 1) == -1);
   BPF_ASSERT(errno == EPERM);
 }
 
@@ skipping 1457 matching lines @@
                             &pid) == -EPERM);
 }
 
 BPF_TEST(SandboxBPF, PthreadEquality, PthreadPolicyEquality) { PthreadTest(); }
 
 BPF_TEST(SandboxBPF, PthreadBitMask, PthreadPolicyBitMask) { PthreadTest(); }
 
 }  // namespace
 
 }  // namespace sandbox