SECCOMP-BPF: Added supported for inspection system call arguments from BPF filters.

sandbox/linux/seccomp-bpf/syscall_iterator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h"
 
 namespace playground2 {
 
 uint32_t SyscallIterator::Next() {
   if (done_) {
     return num_;
   }
 
   uint32_t val;
   do {
     // |num_| has been initialized to 0, which we assume is also MIN_SYSCALL.
     // This true for supported architectures (Intel and ARM EABI).
-    CHECK_EQ(MIN_SYSCALL, 0u);
+    if (MIN_SYSCALL != 0u) {
+      SANDBOX_DIE("MIN_SYSCALL must be zero");
+    }
     val = num_;
 
     // First we iterate up to MAX_PUBLIC_SYSCALL, which is equal to MAX_SYSCALL
     // on Intel architectures, but leaves room for private syscalls on ARM.
     if (num_ <= MAX_PUBLIC_SYSCALL) {
       if (invalid_only_ && num_ < MAX_PUBLIC_SYSCALL) {
         num_ = MAX_PUBLIC_SYSCALL;
       } else {
         ++num_;
       }
@@ skipping 41 matching lines @@
   uint32_t min_syscall = MIN_SYSCALL;
   if (num >= min_syscall && num <= MAX_PUBLIC_SYSCALL) {
     return true;
   }
   if (IsArmPrivate(num)) {
     return true;
   }
   return false;
 }
 
+#if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))

[jln (very slow on Chromium), 2012/12/06 00:35:00]

I'm curious: what broke here ?

[Markus (顧孟勤), 2012/12/12 20:54:35]

I believe one of our compilers (clang?) didn't like that I am not using the
"num" argument. This was easiest to fix by adjusting the function signature and
leaving out the parameter name.

And at that point, moving the "#if" statements around made the code a lot more
readable than what it was before.

On 2012/12/06 00:35:00, Julien Tinnes wrote:

 bool SyscallIterator::IsArmPrivate(uint32_t num) {
-#if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
   return (num >= MIN_PRIVATE_SYSCALL && num <= MAX_PRIVATE_SYSCALL) ||
          (num >= MIN_GHOST_SYSCALL && num <= MAX_SYSCALL);
+}
 #else
+bool SyscallIterator::IsArmPrivate(uint32_t) {
   return false;
+}
 #endif
-}
 
 }  // namespace