sandbox_bpf: rework how unsafe traps are compiled/verified

sandbox/linux/seccomp-bpf/trap.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__
 #define SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__
 
 #include <signal.h>
 #include <stdint.h>
 
@@ skipping 46 matching lines @@
   // Enables support for unsafe traps in the SIGSYS signal handler. This is a
   // one-way fuse. It works in conjunction with the BPF compiler emitting code
   // that unconditionally allows system calls, if they have a magic return
   // address (i.e. SandboxSyscall(-1)).
   // Once unsafe traps are enabled, the sandbox is essentially compromised.
   // But this is still a very useful feature for debugging purposes. Use with
   // care. This feature is availably only if enabled by the user (see above).
   // Returns "true", if unsafe traps were turned on.
   static bool EnableUnsafeTrapsInSigSysHandler();
 
-  // Returns true if a safe trap handler is associated with a
-  // particular trap ID.
-  static bool IsSafeTrapId(uint16_t id);
-
  private:
   struct TrapKey {
     TrapKey() : fnc(NULL), aux(NULL), safe(false) {}
     TrapKey(TrapFnc f, const void* a, bool s) : fnc(f), aux(a), safe(s) {}
     TrapFnc fnc;
     const void* aux;
     bool safe;
     bool operator<(const TrapKey&) const;
   };
   typedef std::map<TrapKey, uint16_t> TrapIds;
@@ skipping 36 matching lines @@
   bool has_unsafe_traps_;       // Whether unsafe traps have been enabled
 
   // Copying and assigning is unimplemented. It doesn't make sense for a
   // singleton.
   DISALLOW_COPY_AND_ASSIGN(Trap);
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__