Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.h

Index: sandbox/linux/seccomp-bpf/codegen.h
diff --git a/sandbox/linux/seccomp-bpf/codegen.h b/sandbox/linux/seccomp-bpf/codegen.h
index b7d1d3904cc3189479ee2f0f97e28e891c44be44..079aa6c0ee417ec454df81e9704b1494d08dde1b 100644
--- a/sandbox/linux/seccomp-bpf/codegen.h
+++ b/sandbox/linux/seccomp-bpf/codegen.h
@@ -77,6 +77,12 @@ class CodeGen {
   // or if a (conditional) jump still has an unsatisfied target.
   void JoinInstructions(Instruction *head, Instruction *tail);
 
+  // Traverse the graph of instructions and visit each instruction once.
+  // Traversal order is implementation-defined. It is acceptable to make
+  // changes to the graph from within the callback function. These changes
+  // do not affect traversal.
+  void Traverse(Instruction *, void (*fnc)(Instruction *, void *), void *);

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Please, name and document the parameter, this is impossible to understand as-is.

+
   // Compiles the graph of instructions into a BPF program that can be passed
   // to the kernel. Please note that this function modifies the graph in place
   // and must therefore only be called once per graph.
@@ -85,6 +91,9 @@ class CodeGen {
  private:
   friend class CodeGenUnittestHelper;
 
+  // Helper function for Traverse()

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Nit: "." at the end.

+  void TraverseRecursively(std::set<Instruction *> *, Instruction *);

[jln (very slow on Chromium), 2012/11/15 01:51:52]

Same here

+
   // Find all the instructions that are the target of BPF_JMPs.
   void FindBranchTargets(const Instruction& instructions,
                          BranchTargets *branch_targets);