sandbox_bpf: rework how unsafe traps are compiled/verified

sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h

Index: sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h b/sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h
index 5a26f2bf54692121d5f800dcb15fef48ac1dc7fe..8f84a03739d3d14a116bb10a4d26fee8ccd1fc2b 100644
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h
+++ b/sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h
@@ -32,6 +32,9 @@ class SANDBOX_EXPORT SandboxBPFPolicy {
   // system calls.  The default implementation is to return ENOSYS.
   virtual ErrorCode InvalidSyscall(SandboxBPF* sandbox_compiler) const;
 
+  // HasUnsafeTraps returns true if the policy includes any unsafe traps.
+  virtual bool HasUnsafeTraps() const = 0;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(SandboxBPFPolicy);
 };