Rewrite all BPF policies to use DSL API

content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.h"
 
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "build/build_config.h"
 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
-using sandbox::ErrorCode;
-using sandbox::SandboxBPF;
+using namespace sandbox::bpf_dsl;
 using sandbox::SyscallSets;
 
 namespace content {
 
 namespace {
 
 inline bool IsChromeOS() {
 #if defined(OS_CHROMEOS)
   return true;
 #else
@@ skipping 51 matching lines @@
   AddArmMaliGpuWhitelist(read_whitelist, write_whitelist);
 }
 
 class CrosArmGpuBrokerProcessPolicy : public CrosArmGpuProcessPolicy {
  public:
   static sandbox::SandboxBPFPolicy* Create() {
     return new CrosArmGpuBrokerProcessPolicy();
   }
   virtual ~CrosArmGpuBrokerProcessPolicy() {}
 
-  virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
-                                    int system_call_number) const OVERRIDE;
+  virtual ResultExpr EvaluateSyscall(int system_call_number) const OVERRIDE;
 
  private:
   CrosArmGpuBrokerProcessPolicy() : CrosArmGpuProcessPolicy(false) {}
   DISALLOW_COPY_AND_ASSIGN(CrosArmGpuBrokerProcessPolicy);
 };
 
 // A GPU broker policy is the same as a GPU policy with open and
 // openat allowed.
-ErrorCode CrosArmGpuBrokerProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
-    int sysno) const {
+ResultExpr CrosArmGpuBrokerProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
     case __NR_access:
     case __NR_open:
     case __NR_openat:
-      return ErrorCode(ErrorCode::ERR_ALLOWED);
+      return Allow();
     default:
-      return CrosArmGpuProcessPolicy::EvaluateSyscall(sandbox, sysno);
+      return CrosArmGpuProcessPolicy::EvaluateSyscall(sysno);
   }
 }
 
 }  // namespace
 
 CrosArmGpuProcessPolicy::CrosArmGpuProcessPolicy(bool allow_shmat)
     : allow_shmat_(allow_shmat) {}
 
 CrosArmGpuProcessPolicy::~CrosArmGpuProcessPolicy() {}
 
-ErrorCode CrosArmGpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
-                                                   int sysno) const {
+ResultExpr CrosArmGpuProcessPolicy::EvaluateSyscall(int sysno) const {
 #if defined(__arm__)
   if (allow_shmat_ && sysno == __NR_shmat)
-    return ErrorCode(ErrorCode::ERR_ALLOWED);
+    return Allow();
 #endif  // defined(__arm__)
 
   switch (sysno) {
 #if defined(__arm__)
     // ARM GPU sandbox is started earlier so we need to allow networking
     // in the sandbox.
     case __NR_connect:
     case __NR_getpeername:
     case __NR_getsockname:
     case __NR_sysinfo:
     case __NR_uname:
-      return ErrorCode(ErrorCode::ERR_ALLOWED);
+      return Allow();
     // Allow only AF_UNIX for |domain|.
     case __NR_socket:
     case __NR_socketpair:
-      return sandbox->Cond(0, ErrorCode::TP_32BIT,
-                           ErrorCode::OP_EQUAL, AF_UNIX,
-                           ErrorCode(ErrorCode::ERR_ALLOWED),
-                           ErrorCode(EPERM));
+      return If(Arg<int>(0) == AF_UNIX).Then(Allow()).Else(Error(EPERM));
 #endif  // defined(__arm__)
     default:
       if (SyscallSets::IsAdvancedScheduler(sysno))
-        return ErrorCode(ErrorCode::ERR_ALLOWED);
+        return Allow();
 
       // Default to the generic GPU policy.
-      return GpuProcessPolicy::EvaluateSyscall(sandbox, sysno);
+      return GpuProcessPolicy::EvaluateSyscall(sysno);
   }
 }
 
 bool CrosArmGpuProcessPolicy::PreSandboxHook() {
   DCHECK(IsChromeOS() && IsArchitectureArm());
   // Create a new broker process.
   DCHECK(!broker_process());
 
   std::vector<std::string> read_whitelist_extra;
   std::vector<std::string> write_whitelist_extra;
@@ skipping 11 matching lines @@
   // Preload the Tegra V4L2 (video decode acceleration) library.
   dlopen("/usr/lib/libtegrav4l2.so", dlopen_flag);
   // Resetting errno since platform-specific libraries will fail on other
   // platforms.
   errno = 0;
 
   return true;
 }
 
 }  // namespace content