bpf_dsl: decouple PolicyCompiler from Syscall

sandbox/linux/seccomp-bpf/sandbox_bpf.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 
 // Some headers on Android are missing cdefs: crbug.com/172337.
 // (We can't use OS_ANDROID here since build_config.h is not included).
 #if defined(ANDROID)
 #include <sys/cdefs.h>
@@ skipping 61 matching lines @@
   if (rv == -1 && errno == EFAULT) {
     return true;
   } else {
     // TODO(jln): turn these into DCHECK after 417888 is considered fixed.
     CHECK_EQ(-1, rv);
     CHECK(ENOSYS == errno || EINVAL == errno);
     return false;
   }
 }
 
+uint64_t EscapePC() {
+  intptr_t rv = Syscall::Call(-1);
+  if (rv == -1 && errno == ENOSYS) {
+    return 0;
+  }
+  return static_cast<uint64_t>(static_cast<uintptr_t>(rv));
+}
+
 }  // namespace
 
 SandboxBPF::SandboxBPF(bpf_dsl::Policy* policy)
     : proc_task_fd_(), sandbox_has_started_(false), policy_(policy) {
 }
 
 SandboxBPF::~SandboxBPF() {
 }
 
 // static
@@ skipping 86 matching lines @@
       static_cast<intptr_t>(args.args[5]));
 }
 
 scoped_ptr<CodeGen::Program> SandboxBPF::AssembleFilter(
     bool force_verification) {
 #if !defined(NDEBUG)
   force_verification = true;
 #endif
   DCHECK(policy_);
   bpf_dsl::PolicyCompiler compiler(policy_.get(), Trap::Registry());
+  if (Trap::SandboxDebuggingAllowedByUser()) {
+    compiler.DangerousSetEscapePC(EscapePC());
+  }
   scoped_ptr<CodeGen::Program> program = compiler.Compile();
 
   // Make sure compilation resulted in a BPF program that executes
   // correctly. Otherwise, there is an internal error in our BPF compiler.
   // There is really nothing the caller can do until the bug is fixed.
   if (force_verification) {
     // Verification is expensive. We only perform this step, if we are
     // compiled in debug mode, or if the caller explicitly requested
     // verification.
 
@@ skipping 49 matching lines @@
   } else {
     if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
       SANDBOX_DIE("Kernel refuses to turn on BPF filters");
     }
   }
 
   sandbox_has_started_ = true;
 }
 
 }  // namespace sandbox