Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/codegen.h"
 
 
 namespace playground2 {
 
 CodeGen::CodeGen()
@@ skipping 127 matching lines @@
   } else if (BPF_CLASS(head->code) == BPF_RET) {
     SANDBOX_DIE("Cannot append instructions after a return statement");
   } else if (head->next) {
     SANDBOX_DIE("Cannot append instructions in the middle of a sequence");
   } else {
     head->next = tail;
   }
   return;
 }
 
+void CodeGen::TraverseRecursively(std::set<Instruction *> *visited,

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Does this really need to be a class method ?

It looks like it would work without being declared in codegen.h and you can put
it directly in this file in the anonymous namespace (don't forget to add a
comment explaining it though).

+                                  Instruction *instruction) {
+  if (visited->find(instruction) == visited->end()) {
+    visited->insert(instruction);
+    switch (BPF_CLASS(instruction->code)) {
+    case BPF_JMP:
+      if (BPF_OP(instruction->code) != BPF_JA) {
+        TraverseRecursively(visited, instruction->jf_ptr);
+      }
+      TraverseRecursively(visited, instruction->jt_ptr);
+      break;
+    default:

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Please put default at the end of the switch.

+      TraverseRecursively(visited, instruction->next);
+      break;
+    case BPF_RET:
+      break;
+    }
+  }
+}
+
+void CodeGen::Traverse(Instruction *instruction,
+                       void (*fnc)(Instruction *, void *), void *aux) {
+  std::set<Instruction *> visited;
+  TraverseRecursively(&visited, instruction);
+  for (std::set<Instruction *>::const_iterator iter = visited.begin();
+       iter != visited.end();
+       ++iter) {
+    fnc(*iter, aux);
+  }
+}
+
 void CodeGen::FindBranchTargets(const Instruction& instructions,
                                 BranchTargets *branch_targets) {
   // Follow all possible paths through the "instructions" graph and compute
   // a list of branch targets. This will later be needed to compute the
   // boundaries of basic blocks.
   // We maintain a set of all instructions that we have previously seen. This
   // set ultimately converges on all instructions in the program.
   std::set<const Instruction *> seen_instructions;
   Instructions stack;
   for (const Instruction *insn = &instructions; insn; ) {
@@ skipping 490 matching lines @@
     CutGraphIntoBasicBlocks(instructions, branch_targets, &all_blocks);
   MergeTails(&all_blocks);
   BasicBlocks basic_blocks;
   TopoSortBasicBlocks(first_block, all_blocks, &basic_blocks);
   ComputeRelativeJumps(&basic_blocks, all_blocks);
   ConcatenateBasicBlocks(basic_blocks, program);
   return;
 }
 
 }  // namespace