Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
 
 #include <map>
 #include <set>
 #include <vector>
@@ skipping 59 matching lines @@
                                Instruction *next = NULL);
   Instruction *MakeInstruction(uint16_t code, const ErrorCode& err);
   Instruction *MakeInstruction(uint16_t code, uint32_t k,
                                Instruction *jt, Instruction *jf);
 
   // Join two (sequences of) instructions. This is useful, if the "next"
   // parameter had not originally been given in the call to MakeInstruction(),
   // or if a (conditional) jump still has an unsatisfied target.
   void JoinInstructions(Instruction *head, Instruction *tail);
 
+  // Traverse the graph of instructions and visit each instruction once.
+  // Traversal order is implementation-defined. It is acceptable to make
+  // changes to the graph from within the callback function. These changes
+  // do not affect traversal.
+  void Traverse(Instruction *, void (*fnc)(Instruction *, void *), void *);

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Please, name and document the parameter, this is impossible to understand as-is.

+
   // Compiles the graph of instructions into a BPF program that can be passed
   // to the kernel. Please note that this function modifies the graph in place
   // and must therefore only be called once per graph.
   void Compile(Instruction *instructions, Sandbox::Program *program);
 
  private:
   friend class CodeGenUnittestHelper;
 
+  // Helper function for Traverse()

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Nit: "." at the end.

+  void TraverseRecursively(std::set<Instruction *> *, Instruction *);

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Same here

+
   // Find all the instructions that are the target of BPF_JMPs.
   void FindBranchTargets(const Instruction& instructions,
                          BranchTargets *branch_targets);
 
   // Combine instructions between "head" and "tail" into a new basic block.
   // Basic blocks are defined as sequences of instructions whose only branch
   // target is the very first instruction; furthermore, any BPF_JMP or BPF_RET
   // instruction must be at the very end of the basic block.
   BasicBlock *MakeBasicBlock(Instruction *head, Instruction *tail);
 
@@ skipping 40 matching lines @@
   BasicBlocks  basic_blocks_;
 
   // Compile() must only ever be called once as it makes destructive changes
   // to the DAG.
   bool compiled_;
 };
 
 }  // namespace
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__