sandbox_bpf: rework how unsafe traps are compiled/verified

sandbox/linux/bpf_dsl/bpf_dsl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 
 #include <stdint.h>
 
 #include <utility>
@@ skipping 94 matching lines @@
   // Optional overload for specifying alternate behavior for invalid
   // system calls.  The default is to return ENOSYS.
   virtual ResultExpr InvalidSyscall() const;
 
   // Override implementations from SandboxBPFPolicy.  Marked as final
   // to prevent mixups with child classes accidentally overloading
   // these instead of the above methods.
   virtual ErrorCode EvaluateSyscall(SandboxBPF* sb,
                                     int sysno) const override final;
   virtual ErrorCode InvalidSyscall(SandboxBPF* sb) const override final;
+  virtual bool HasUnsafeTraps() const override final;
 
   // Helper method so policies can just write Trap(func, aux).
   static ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux);
 
  private:
   DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy);
 };
 
 // Allow specifies a result that the system call should be allowed to
 // execute normally.
@@ skipping 193 matching lines @@
  private:
   friend class base::RefCounted<BoolExprImpl>;
   DISALLOW_COPY_AND_ASSIGN(BoolExprImpl);
 };
 
 // Internal interface implemented by ResultExpr implementations.
 class SANDBOX_EXPORT ResultExprImpl : public base::RefCounted<ResultExprImpl> {
  public:
   ResultExprImpl() {}
   virtual ErrorCode Compile(SandboxBPF* sb) const = 0;
+  virtual bool HasUnsafeTraps() const;
 
  protected:
   virtual ~ResultExprImpl() {}
 
  private:
   friend class base::RefCounted<ResultExprImpl>;
   DISALLOW_COPY_AND_ASSIGN(ResultExprImpl);
 };
 
 }  // namespace internal
@@ skipping 42 matching lines @@
 
 template <typename T>
 ResultExpr Caser<T>::Default(ResultExpr result) const {
   return elser_.Else(result);
 }
 
 }  // namespace bpf_dsl
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_