Create a class for seccomp-bpf sandboxing in content.

content/common/sandbox_linux.h

Index: content/common/sandbox_linux.h
diff --git a/content/common/sandbox_linux.h b/content/common/sandbox_linux.h
index 8502dfb372450d49e99c66d8eda1a35ffbbeea5a..f5e0922da1ef1b37416ffa30717b3b30eb7e916c 100644
--- a/content/common/sandbox_linux.h
+++ b/content/common/sandbox_linux.h
@@ -5,14 +5,12 @@
 #ifndef CONTENT_COMMON_SANDBOX_LINUX_H_
 #define CONTENT_COMMON_SANDBOX_LINUX_H_
 
+#include <string>
+
+#include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "content/public/common/sandbox_linux.h"
 
-// TODO(jln) move this somewhere else.
-#if defined(__i386__) || defined(__x86_64__)
-#define SECCOMP_BPF_SANDBOX
-#endif
-
 template <typename T> struct DefaultSingletonTraits;
 namespace sandbox { class SetuidSandboxClient; }
 
@@ -60,7 +58,9 @@ class LinuxSandbox {
   // Since we need to provide the status before the sandboxes are actually
   // started, this returns what will actually happen once the various Start*
   // functions are called from inside a renderer.
-  int GetStatus();
+  int GetStatus() const;
+  // Is the current process single threaded ?
+  bool IsSingleThreaded() const;
 
   // Simple accessor for our instance of the setuid sandbox. Will never return
   // NULL.
@@ -71,21 +71,24 @@ class LinuxSandbox {
   // Check the policy and eventually start the seccomp-legacy sandbox.
   bool StartSeccompLegacy(const std::string& process_type);
   // Check the policy and eventually start the seccomp-bpf sandbox.
-  // TODO(jln): not implemented at the moment.
   bool StartSeccompBpf(const std::string& process_type);
 
  private:
   friend struct DefaultSingletonTraits<LinuxSandbox>;
-  bool ShouldEnableSeccompLegacy(const std::string& process_type);
+
+  // We must have be pre_initialized_ before using either of these.

[Markus (顧孟勤), 2012/08/02 20:39:13]

s/be/been/

[jln (very slow on Chromium), 2012/08/02 20:50:40]

Done.

+  bool seccomp_legacy_supported() const;
+  bool seccomp_bpf_supported() const;
 
   int proc_fd_;
   // Have we been through PreinitializeSandbox or PreinitializeSandboxBegin ?
   bool pre_initialized_;
   bool seccomp_legacy_supported_;  // Accurate if pre_initialized_.
+  bool seccomp_bpf_supported_;  // Accurate if pre_initialized_.
   scoped_ptr<sandbox::SetuidSandboxClient> setuid_sandbox_client_;
-  LinuxSandbox();
+
   ~LinuxSandbox();
-  DISALLOW_COPY_AND_ASSIGN(LinuxSandbox);
+  DISALLOW_IMPLICIT_CONSTRUCTORS(LinuxSandbox);
 };
 
 }  // namespace content