Add a platform-specific syscall number iterator.

sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc

Index: sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc b/sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc
index 1422b5918d9a2d875bd5366a30f27a365995ac16..ffda1a85f20cc73da68fbd428ef7c2acf3387595 100644
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc
+++ b/sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc
@@ -46,6 +46,11 @@ ErrorCode BlacklistNanosleepPolicy(int sysno) {
     // FIXME: we should really not have to do that in a trivial policy
     return ErrorCode(ENOSYS);
   }
+#if defined(__arm__)
+  if (!Sandbox::isArmPrivateSyscall(sysno)) {

[jln (very slow on Chromium), 2012/10/11 22:42:00]

I don't understand why this would work. For instance, for EACCESS, which is not
a private syscall, wouldn't we return ENOSYS ?

Asides from that, it's a problem to require every black list-style policy to do
something so complex. Instead, export a IsValidSysCallNumber() method in the
Sandbox class to take care of what's above and here.

[Jorge Lucangeli Obes, 2012/10/12 17:58:23]

Done.

+    return ErrorCode(ENOSYS);
+  }
+#endif
   switch (sysno) {
     case __NR_nanosleep:
       return ErrorCode(EACCES);
@@ -105,6 +110,11 @@ ErrorCode BlacklistNanosleepPolicySigsys(int sysno) {
     // FIXME: we should really not have to do that in a trivial policy
     return ErrorCode(ENOSYS);
   }
+#if defined(__arm__)
+  if (!Sandbox::isArmPrivateSyscall(sysno)) {
+    return ErrorCode(ENOSYS);
+  }
+#endif
   switch (sysno) {
     case __NR_nanosleep:
       return Sandbox::Trap(EnomemHandler,