Update from chromium https://crrev.com/301315

sandbox/linux/seccomp-bpf/sandbox_bpf.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 
 // Some headers on Android are missing cdefs: crbug.com/172337.
 // (We can't use OS_ANDROID here since build_config.h is not included).
 #if defined(ANDROID)
 #include <sys/cdefs.h>
@@ skipping 11 matching lines @@
 #include <sys/wait.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/posix/eintr_wrapper.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
+#include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/bpf_dsl/policy_compiler.h"
 #include "sandbox/linux/seccomp-bpf/codegen.h"
 #include "sandbox/linux/seccomp-bpf/die.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h"
 #include "sandbox/linux/seccomp-bpf/syscall.h"
 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h"
 #include "sandbox/linux/seccomp-bpf/trap.h"
 #include "sandbox/linux/seccomp-bpf/verifier.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 using sandbox::bpf_dsl::Allow;
 using sandbox::bpf_dsl::Error;
 using sandbox::bpf_dsl::ResultExpr;
-using sandbox::bpf_dsl::SandboxBPFDSLPolicy;
 
 namespace sandbox {
 
 namespace {
 
 const int kExpectedExitCode = 100;
 
 #if !defined(NDEBUG)
 void WriteFailedStderrSetupMessage(int out_fd) {
   const char* error_string = strerror(errno);
   static const char msg[] =
       "You have reproduced a puzzling issue.\n"
       "Please, report to crbug.com/152530!\n"
       "Failed to set up stderr: ";
   if (HANDLE_EINTR(write(out_fd, msg, sizeof(msg) - 1)) > 0 && error_string &&
       HANDLE_EINTR(write(out_fd, error_string, strlen(error_string))) > 0 &&
       HANDLE_EINTR(write(out_fd, "\n", 1))) {
   }
 }
 #endif  // !defined(NDEBUG)
 
 // We define a really simple sandbox policy. It is just good enough for us
 // to tell that the sandbox has actually been activated.
-class ProbePolicy : public SandboxBPFDSLPolicy {
+class ProbePolicy : public bpf_dsl::Policy {
  public:
   ProbePolicy() {}
   virtual ~ProbePolicy() {}
 
   virtual ResultExpr EvaluateSyscall(int sysnum) const override {
     switch (sysnum) {
       case __NR_getpid:
         // Return EPERM so that we can check that the filter actually ran.
         return Error(EPERM);
       case __NR_exit_group:
         // Allow exit() with a non-default return code.
         return Allow();
       default:
         // Make everything else fail in an easily recognizable way.
         return Error(EINVAL);
     }
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ProbePolicy);
 };
 
 void ProbeProcess(void) {
   if (syscall(__NR_getpid) < 0 && errno == EPERM) {
     syscall(__NR_exit_group, static_cast<intptr_t>(kExpectedExitCode));
   }
 }
 
-class AllowAllPolicy : public SandboxBPFDSLPolicy {
+class AllowAllPolicy : public bpf_dsl::Policy {
  public:
   AllowAllPolicy() {}
   virtual ~AllowAllPolicy() {}
 
   virtual ResultExpr EvaluateSyscall(int sysnum) const override {
     DCHECK(SandboxBPF::IsValidSyscallNumber(sysnum));
     return Allow();
   }
 
  private:
@@ skipping 36 matching lines @@
     : quiet_(false), proc_fd_(-1), sandbox_has_started_(false), policy_() {
 }
 
 SandboxBPF::~SandboxBPF() {
 }
 
 bool SandboxBPF::IsValidSyscallNumber(int sysnum) {
   return SyscallSet::IsValid(sysnum);
 }
 
-bool SandboxBPF::RunFunctionInPolicy(
-    void (*code_in_sandbox)(),
-    scoped_ptr<bpf_dsl::SandboxBPFDSLPolicy> policy) {
+bool SandboxBPF::RunFunctionInPolicy(void (*code_in_sandbox)(),
+                                     scoped_ptr<bpf_dsl::Policy> policy) {
   // Block all signals before forking a child process. This prevents an
   // attacker from manipulating our test by sending us an unexpected signal.
   sigset_t old_mask, new_mask;
   if (sigfillset(&new_mask) || sigprocmask(SIG_BLOCK, &new_mask, &old_mask)) {
     SANDBOX_DIE("sigprocmask() failed");
   }
   int fds[2];
   if (pipe2(fds, O_NONBLOCK | O_CLOEXEC)) {
     SANDBOX_DIE("pipe() failed");
   }
@@ skipping 98 matching lines @@
     }
   }
   if (IGNORE_EINTR(close(fds[0]))) {
     SANDBOX_DIE("close() failed");
   }
 
   return rc;
 }
 
 bool SandboxBPF::KernelSupportSeccompBPF() {
-  return RunFunctionInPolicy(
-             ProbeProcess,
-             scoped_ptr<bpf_dsl::SandboxBPFDSLPolicy>(new ProbePolicy())) &&
-         RunFunctionInPolicy(
-             TryVsyscallProcess,
-             scoped_ptr<bpf_dsl::SandboxBPFDSLPolicy>(new AllowAllPolicy()));
+  return RunFunctionInPolicy(ProbeProcess,
+                             scoped_ptr<bpf_dsl::Policy>(new ProbePolicy())) &&
+         RunFunctionInPolicy(TryVsyscallProcess,
+                             scoped_ptr<bpf_dsl::Policy>(new AllowAllPolicy()));
 }
 
 // static
 SandboxBPF::SandboxStatus SandboxBPF::SupportsSeccompSandbox(int proc_fd) {
   // It the sandbox is currently active, we clearly must have support for
   // sandboxing.
   if (status_ == STATUS_ENABLED) {
     return status_;
   }
 
@@ skipping 123 matching lines @@
   // Install the filters.
   InstallFilter(supports_tsync || thread_state == PROCESS_MULTI_THREADED);
 
   // We are now inside the sandbox.
   status_ = STATUS_ENABLED;
 
   return true;
 }
 
 // Don't take a scoped_ptr here, polymorphism make their use awkward.
-void SandboxBPF::SetSandboxPolicy(bpf_dsl::SandboxBPFDSLPolicy* policy) {
+void SandboxBPF::SetSandboxPolicy(bpf_dsl::Policy* policy) {
   DCHECK(!policy_);
   if (sandbox_has_started_) {
     SANDBOX_DIE("Cannot change policy after sandbox has started");
   }
   policy_.reset(policy);
 }
 
 void SandboxBPF::InstallFilter(bool must_sync_threads) {
   // We want to be very careful in not imposing any requirements on the
   // policies that are set with SetSandboxPolicy(). This means, as soon as
@@ skipping 79 matching lines @@
                        static_cast<intptr_t>(args.args[1]),
                        static_cast<intptr_t>(args.args[2]),
                        static_cast<intptr_t>(args.args[3]),
                        static_cast<intptr_t>(args.args[4]),
                        static_cast<intptr_t>(args.args[5]));
 }
 
 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN;
 
 }  // namespace sandbox