SECCOMP-BPF: Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/codegen.h"
 
 
+namespace {
+
+// Helper function for Traverse().
+void TraverseRecursively(std::set<playground2::Instruction *> *visited,
+                         playground2::Instruction *instruction) {
+  if (visited->find(instruction) == visited->end()) {
+    visited->insert(instruction);
+    switch (BPF_CLASS(instruction->code)) {
+    case BPF_JMP:
+      if (BPF_OP(instruction->code) != BPF_JA) {
+        TraverseRecursively(visited, instruction->jf_ptr);
+      }
+      TraverseRecursively(visited, instruction->jt_ptr);
+      break;
+    case BPF_RET:
+      break;
+    default:
+      TraverseRecursively(visited, instruction->next);
+      break;
+    }
+  }
+}
+
+}  // namespace
+
 namespace playground2 {
 
 CodeGen::CodeGen()
     : compiled_(false) {
 }
 
 CodeGen::~CodeGen() {
   for (Instructions::iterator iter = instructions_.begin();
        iter != instructions_.end();
        ++iter) {
@@ skipping 120 matching lines @@
   } else if (BPF_CLASS(head->code) == BPF_RET) {
     SANDBOX_DIE("Cannot append instructions after a return statement");
   } else if (head->next) {
     SANDBOX_DIE("Cannot append instructions in the middle of a sequence");
   } else {
     head->next = tail;
   }
   return;
 }
 
+void CodeGen::Traverse(Instruction *instruction,
+                       void (*fnc)(Instruction *, void *), void *aux) {
+  std::set<Instruction *> visited;
+  TraverseRecursively(&visited, instruction);
+  for (std::set<Instruction *>::const_iterator iter = visited.begin();
+       iter != visited.end();
+       ++iter) {
+    fnc(*iter, aux);
+  }
+}
+
 void CodeGen::FindBranchTargets(const Instruction& instructions,
                                 BranchTargets *branch_targets) {
   // Follow all possible paths through the "instructions" graph and compute
   // a list of branch targets. This will later be needed to compute the
   // boundaries of basic blocks.
   // We maintain a set of all instructions that we have previously seen. This
   // set ultimately converges on all instructions in the program.
   std::set<const Instruction *> seen_instructions;
   Instructions stack;
   for (const Instruction *insn = &instructions; insn; ) {
@@ skipping 490 matching lines @@
     CutGraphIntoBasicBlocks(instructions, branch_targets, &all_blocks);
   MergeTails(&all_blocks);
   BasicBlocks basic_blocks;
   TopoSortBasicBlocks(first_block, all_blocks, &basic_blocks);
   ComputeRelativeJumps(&basic_blocks, all_blocks);
   ConcatenateBasicBlocks(basic_blocks, program);
   return;
 }
 
 }  // namespace