SECCOMP-BPF: Added supported for inspection system call arguments from BPF filters.

sandbox/linux/seccomp-bpf/syscall_iterator.cc

Index: sandbox/linux/seccomp-bpf/syscall_iterator.cc
diff --git a/sandbox/linux/seccomp-bpf/syscall_iterator.cc b/sandbox/linux/seccomp-bpf/syscall_iterator.cc
index 583dcf6e9cb55166f6866d45d8a62514a14d376f..20fddbf4042bbf9f600a4488a6fe27474db6fb25 100644
--- a/sandbox/linux/seccomp-bpf/syscall_iterator.cc
+++ b/sandbox/linux/seccomp-bpf/syscall_iterator.cc
@@ -16,7 +16,9 @@ uint32_t SyscallIterator::Next() {
   do {
     // |num_| has been initialized to 0, which we assume is also MIN_SYSCALL.
     // This true for supported architectures (Intel and ARM EABI).
-    CHECK_EQ(MIN_SYSCALL, 0u);
+    if (MIN_SYSCALL != 0u) {
+      SANDBOX_DIE("MIN_SYSCALL must be zero");
+    }

[jln (very slow on Chromium), 2012/12/14 02:28:02]

We should perhaps make this a COMPILE_ASSERT ?

     val = num_;
 
     // First we iterate up to MAX_PUBLIC_SYSCALL, which is equal to MAX_SYSCALL
@@ -78,14 +80,16 @@ bool SyscallIterator::IsValid(uint32_t num) {
   return false;
 }
 
-bool SyscallIterator::IsArmPrivate(uint32_t num) {
 #if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
+bool SyscallIterator::IsArmPrivate(uint32_t num) {
   return (num >= MIN_PRIVATE_SYSCALL && num <= MAX_PRIVATE_SYSCALL) ||
          (num >= MIN_GHOST_SYSCALL && num <= MAX_SYSCALL);
+}
 #else
+bool SyscallIterator::IsArmPrivate(uint32_t) {
   return false;
-#endif
 }
+#endif
 
 }  // namespace