Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.cc

Index: sandbox/linux/seccomp-bpf/codegen.cc
diff --git a/sandbox/linux/seccomp-bpf/codegen.cc b/sandbox/linux/seccomp-bpf/codegen.cc
index 8b36315cff43bd4dd1d6b1fcb539d2a5b55b72ed..79687e1b3c08783c5ba66b1afc7297922a0bdf9a 100644
--- a/sandbox/linux/seccomp-bpf/codegen.cc
+++ b/sandbox/linux/seccomp-bpf/codegen.cc
@@ -145,6 +145,37 @@ void CodeGen::JoinInstructions(Instruction *head, Instruction *tail) {
   return;
 }
 
+void CodeGen::TraverseRecursively(std::set<Instruction *> *visited,

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Does this really need to be a class method ?

It looks like it would work without being declared in codegen.h and you can put
it directly in this file in the anonymous namespace (don't forget to add a
comment explaining it though).

+                                  Instruction *instruction) {
+  if (visited->find(instruction) == visited->end()) {
+    visited->insert(instruction);
+    switch (BPF_CLASS(instruction->code)) {
+    case BPF_JMP:
+      if (BPF_OP(instruction->code) != BPF_JA) {
+        TraverseRecursively(visited, instruction->jf_ptr);
+      }
+      TraverseRecursively(visited, instruction->jt_ptr);
+      break;
+    default:

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Please put default at the end of the switch.

+      TraverseRecursively(visited, instruction->next);
+      break;
+    case BPF_RET:
+      break;
+    }
+  }
+}
+
+void CodeGen::Traverse(Instruction *instruction,
+                       void (*fnc)(Instruction *, void *), void *aux) {
+  std::set<Instruction *> visited;
+  TraverseRecursively(&visited, instruction);
+  for (std::set<Instruction *>::const_iterator iter = visited.begin();
+       iter != visited.end();
+       ++iter) {
+    fnc(*iter, aux);
+  }
+}
+
 void CodeGen::FindBranchTargets(const Instruction& instructions,
                                 BranchTargets *branch_targets) {
   // Follow all possible paths through the "instructions" graph and compute