Update from chromium https://crrev.com/301315

sandbox/linux/bpf_dsl/bpf_dsl_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
 #include <sys/utsname.h>
 #include <unistd.h>
 
 #include "base/files/scoped_file.h"
 #include "base/macros.h"
 #include "build/build_config.h"
+#include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 #include "sandbox/linux/seccomp-bpf/syscall.h"
 
 #define CASES SANDBOX_BPF_DSL_CASES
 
 // Helper macro to assert that invoking system call |sys| directly via
 // Syscall::Call with arguments |...| returns |res|.
 // Errors can be asserted by specifying a value like "-EINVAL".
 #define ASSERT_SYSCALL_RESULT(res, sys, ...) \
@@ skipping 25 matching lines @@
     return Syscall::Call(__NR_setresuid, ruid, euid, suid);
   }
 
 #if !defined(ARCH_CPU_X86)
   static int socketpair(int domain, int type, int protocol, int sv[2]) {
     return Syscall::Call(__NR_socketpair, domain, type, protocol, sv);
   }
 #endif
 };
 
-class BasicPolicy : public SandboxBPFDSLPolicy {
+class BasicPolicy : public Policy {
  public:
   BasicPolicy() {}
   virtual ~BasicPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_getpgid) {
       const Arg<pid_t> pid(0);
       return If(pid == 0, Error(EPERM)).Else(Error(EINVAL));
     }
     if (sysno == __NR_setuid) {
       const Arg<uid_t> uid(0);
       return If(uid != 42, Error(ESRCH)).Else(Error(ENOMEM));
     }
     return Allow();
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(BasicPolicy);
 };
 
 BPF_TEST_C(BPFDSL, Basic, BasicPolicy) {
   ASSERT_SYSCALL_RESULT(-EPERM, getpgid, 0);
   ASSERT_SYSCALL_RESULT(-EINVAL, getpgid, 1);
 
   ASSERT_SYSCALL_RESULT(-ENOMEM, setuid, 42);
   ASSERT_SYSCALL_RESULT(-ESRCH, setuid, 43);
 }
 
 /* On IA-32, socketpair() is implemented via socketcall(). :-( */
 #if !defined(ARCH_CPU_X86)
-class BooleanLogicPolicy : public SandboxBPFDSLPolicy {
+class BooleanLogicPolicy : public Policy {
  public:
   BooleanLogicPolicy() {}
   virtual ~BooleanLogicPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_socketpair) {
       const Arg<int> domain(0), type(1), protocol(2);
       return If(domain == AF_UNIX &&
                     (type == SOCK_STREAM || type == SOCK_DGRAM) &&
                     protocol == 0,
                 Error(EPERM)).Else(Error(EINVAL));
@@ skipping 17 matching lines @@
   ASSERT_SYSCALL_RESULT(-EINVAL, socketpair, AF_UNIX, SOCK_SEQPACKET, 0, sv);
   ASSERT_SYSCALL_RESULT(
       -EINVAL, socketpair, AF_UNIX, SOCK_STREAM, IPPROTO_TCP, sv);
 
   // Completely unacceptable combination; should also return EINVAL.
   ASSERT_SYSCALL_RESULT(
       -EINVAL, socketpair, AF_INET, SOCK_SEQPACKET, IPPROTO_UDP, sv);
 }
 #endif  // !ARCH_CPU_X86
 
-class MoreBooleanLogicPolicy : public SandboxBPFDSLPolicy {
+class MoreBooleanLogicPolicy : public Policy {
  public:
   MoreBooleanLogicPolicy() {}
   virtual ~MoreBooleanLogicPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_setresuid) {
       const Arg<uid_t> ruid(0), euid(1), suid(2);
       return If(ruid == 0 || euid == 0 || suid == 0, Error(EPERM))
           .ElseIf(ruid == 1 && euid == 1 && suid == 1, Error(EAGAIN))
           .Else(Error(EINVAL));
     }
@@ skipping 16 matching lines @@
   // Expect EINVAL for anything else.
   ASSERT_SYSCALL_RESULT(-EINVAL, setresuid, 5, 1, 1);
   ASSERT_SYSCALL_RESULT(-EINVAL, setresuid, 1, 5, 1);
   ASSERT_SYSCALL_RESULT(-EINVAL, setresuid, 1, 1, 5);
   ASSERT_SYSCALL_RESULT(-EINVAL, setresuid, 3, 4, 5);
 }
 
 static const uintptr_t kDeadBeefAddr =
     static_cast<uintptr_t>(0xdeadbeefdeadbeefULL);
 
-class ArgSizePolicy : public SandboxBPFDSLPolicy {
+class ArgSizePolicy : public Policy {
  public:
   ArgSizePolicy() {}
   virtual ~ArgSizePolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_uname) {
       const Arg<uintptr_t> addr(0);
       return If(addr == kDeadBeefAddr, Error(EPERM)).Else(Allow());
     }
     return Allow();
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ArgSizePolicy);
 };
 
 BPF_TEST_C(BPFDSL, ArgSizeTest, ArgSizePolicy) {
   struct utsname buf;
   ASSERT_SYSCALL_RESULT(0, uname, &buf);
   ASSERT_SYSCALL_RESULT(
       -EPERM, uname, reinterpret_cast<struct utsname*>(kDeadBeefAddr));
 }
 
-class TrappingPolicy : public SandboxBPFDSLPolicy {
+class TrappingPolicy : public Policy {
  public:
   TrappingPolicy() {}
   virtual ~TrappingPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_uname) {
       return Trap(UnameTrap, &count_);
     }
     return Allow();
   }
 
  private:
   static intptr_t count_;
 
   static intptr_t UnameTrap(const struct arch_seccomp_data& data, void* aux) {
     BPF_ASSERT_EQ(&count_, aux);
     return ++count_;
   }
 
   DISALLOW_COPY_AND_ASSIGN(TrappingPolicy);
 };
 
 intptr_t TrappingPolicy::count_;
 
 BPF_TEST_C(BPFDSL, TrapTest, TrappingPolicy) {
   ASSERT_SYSCALL_RESULT(1, uname, NULL);
   ASSERT_SYSCALL_RESULT(2, uname, NULL);
   ASSERT_SYSCALL_RESULT(3, uname, NULL);
 }
 
-class MaskingPolicy : public SandboxBPFDSLPolicy {
+class MaskingPolicy : public Policy {
  public:
   MaskingPolicy() {}
   virtual ~MaskingPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_setuid) {
       const Arg<uid_t> uid(0);
       return If((uid & 0xf) == 0, Error(EINVAL)).Else(Error(EACCES));
     }
     if (sysno == __NR_setgid) {
       const Arg<gid_t> gid(0);
@@ skipping 20 matching lines @@
     const int expect_errno = (gid & 0xf0) == 0xf0 ? EINVAL : EACCES;
     ASSERT_SYSCALL_RESULT(-expect_errno, setgid, gid);
   }
 
   for (pid_t pid = 0; pid < 0x100; ++pid) {
     const int expect_errno = (pid & 0xa5) == 0xa0 ? EINVAL : EACCES;
     ASSERT_SYSCALL_RESULT(-expect_errno, setpgid, pid, 0);
   }
 }
 
-class ElseIfPolicy : public SandboxBPFDSLPolicy {
+class ElseIfPolicy : public Policy {
  public:
   ElseIfPolicy() {}
   virtual ~ElseIfPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_setuid) {
       const Arg<uid_t> uid(0);
       return If((uid & 0xfff) == 0, Error(0))
           .ElseIf((uid & 0xff0) == 0, Error(EINVAL))
           .ElseIf((uid & 0xf00) == 0, Error(EEXIST))
           .Else(Error(EACCES));
@@ skipping 11 matching lines @@
   ASSERT_SYSCALL_RESULT(-EINVAL, setuid, 0x0001);
   ASSERT_SYSCALL_RESULT(-EINVAL, setuid, 0x0002);
 
   ASSERT_SYSCALL_RESULT(-EEXIST, setuid, 0x0011);
   ASSERT_SYSCALL_RESULT(-EEXIST, setuid, 0x0022);
 
   ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0111);
   ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0222);
 }
 
-class SwitchPolicy : public SandboxBPFDSLPolicy {
+class SwitchPolicy : public Policy {
  public:
   SwitchPolicy() {}
   virtual ~SwitchPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_fcntl) {
       const Arg<int> cmd(1);
       const Arg<unsigned long> long_arg(2);
       return Switch(cmd)
           .CASES((F_GETFL, F_GETFD), Error(ENOENT))
           .Case(F_SETFD, If(long_arg == O_CLOEXEC, Allow()).Else(Error(EINVAL)))
@@ skipping 18 matching lines @@
   ASSERT_SYSCALL_RESULT(-EINVAL, fcntl, sock_fd.get(), F_SETFD, 0);
 
   ASSERT_SYSCALL_RESULT(-EPERM, fcntl, sock_fd.get(), F_SETFL, O_RDONLY);
 
   ASSERT_SYSCALL_RESULT(-EACCES, fcntl, sock_fd.get(), F_DUPFD, 0);
 }
 
 }  // namespace
 }  // namespace bpf_dsl
 }  // namespace sandbox