Revert of bpf_dsl: decouple PolicyCompiler from Syscall

sandbox/linux/seccomp-bpf/trap.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/trap.h"
 
 #include <errno.h>
 #include <signal.h>
 #include <string.h>
 #include <sys/syscall.h>
@@ skipping 233 matching lines @@
 bool Trap::TrapKey::operator<(const TrapKey& o) const {
   if (fnc != o.fnc) {
     return fnc < o.fnc;
   } else if (aux != o.aux) {
     return aux < o.aux;
   } else {
     return safe < o.safe;
   }
 }
 
+uint16_t Trap::MakeTrap(TrapFnc fnc, const void* aux, bool safe) {
+  return Registry()->Add(fnc, aux, safe);
+}
+
 uint16_t Trap::Add(TrapFnc fnc, const void* aux, bool safe) {
   if (!safe && !SandboxDebuggingAllowedByUser()) {
     // Unless the user set the CHROME_SANDBOX_DEBUGGING environment variable,
     // we never return an ErrorCode that is marked as "unsafe". This also
     // means, the BPF compiler will never emit code that allow unsafe system
     // calls to by-pass the filter (because they use the magic return address
     // from Syscall::Call(-1)).
 
     // This SANDBOX_DIE() can optionally be removed. It won't break security,
     // but it might make error messages from the BPF compiler a little harder
@@ skipping 78 matching lines @@
     delete[] old_trap_array;
   }
 
   uint16_t id = trap_array_size_ + 1;
   trap_ids_[key] = id;
   trap_array_[trap_array_size_] = key;
   trap_array_size_++;
   return id;
 }
 
-bool Trap::SandboxDebuggingAllowedByUser() {
+bool Trap::SandboxDebuggingAllowedByUser() const {
   const char* debug_flag = getenv(kSandboxDebuggingEnv);
   return debug_flag && *debug_flag;
 }
 
+bool Trap::EnableUnsafeTrapsInSigSysHandler() {
+  return Registry()->EnableUnsafeTraps();
+}
+
 bool Trap::EnableUnsafeTraps() {
   if (!has_unsafe_traps_) {
     // Unsafe traps are a one-way fuse. Once enabled, they can never be turned
     // off again.
     // We only allow enabling unsafe traps, if the user explicitly set an
     // appropriate environment variable. This prevents bugs that accidentally
     // disable all sandboxing for all users.
     if (SandboxDebuggingAllowedByUser()) {
       // We only ever print this message once, when we enable unsafe traps the
       // first time.
       SANDBOX_INFO("WARNING! Disabling sandbox for debugging purposes");
       has_unsafe_traps_ = true;
     } else {
       SANDBOX_INFO(
           "Cannot disable sandbox and use unsafe traps unless "
           "CHROME_SANDBOX_DEBUGGING is turned on first");
     }
   }
   // Returns the, possibly updated, value of has_unsafe_traps_.
   return has_unsafe_traps_;
 }
 
 Trap* Trap::global_trap_;
 
 }  // namespace sandbox