Seccomp: always call setSandboxPolicy in unittest.

sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <ostream>
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/verifier.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ skipping 57 matching lines @@
      Sandbox::STATUS_AVAILABLE) {
     ExitGroup(1);
   }
   Sandbox::setProcFd(proc_fd);
   Sandbox::setSandboxPolicy(evaluator, NULL);
   Sandbox::startSandbox();
 }
 
 void RunInSandbox(Sandbox::EvaluateSyscall evaluator,
                       void (*SandboxedCode)()) {
-  // TODO(jln): Implement IsEqual for ErrorCode
+  // TODO(markus): Implement IsEqual for ErrorCode
   // IsEqual(evaluator(__NR_exit_group), Sandbox::SB_ALLOWED) <<
   //    "You need to always allow exit_group() in your test policy";
   StartSandboxOrDie(evaluator);
   // TODO(jln): find a way to use the testing framework inside
   // SandboxedCode() or at the very least to surface errors
   SandboxedCode();
   // SandboxedCode() should have exited, this is a failure
   ExitGroup(1);
 }
 
 // evaluator should always allow ExitGroup
 // SandboxedCode should ExitGroup(kExpectedReturnValue) if and only if
 // things go as expected.
 void TryPolicyInProcess(Sandbox::EvaluateSyscall evaluator,
                         void (*SandboxedCode)()) {
   // TODO(jln) figure out a way to surface whether we're actually testing
   // something or not.
   if (Sandbox::supportsSeccompSandbox(-1) == Sandbox::STATUS_AVAILABLE) {
     EXPECT_EXIT(RunInSandbox(evaluator, SandboxedCode),
                 ::testing::ExitedWithCode(kExpectedReturnValue),
                 "");
+  } else {
+    // The sandbox is not available. We should still try to exercise what we
+    // can.
+    // TODO(markus): (crbug.com/141545) let us call the compiler from here.
+    Sandbox::setSandboxPolicy(evaluator, NULL);
   }
 }
 
 // A simple blacklist test
 
 Sandbox::ErrorCode BlacklistNanosleepPolicy(int sysno) {
   if (sysno < static_cast<int>(MIN_SYSCALL) ||
       sysno > static_cast<int>(MAX_SYSCALL)) {
     // FIXME: we should really not have to do that in a trivial policy
     return ENOSYS;
@@ skipping 151 matching lines @@
     }
   }
   ExitGroup(kExpectedReturnValue);
 }
 
 TEST(SandboxBpf, SyntheticPolicy) {
   TryPolicyInProcess(SyntheticPolicy, SyntheticProcess);
 }
 
 } // namespace