SECCOMP-BPF: Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
 
 #include <map>
 #include <set>
 #include <vector>
@@ skipping 59 matching lines @@
                                Instruction *next = NULL);
   Instruction *MakeInstruction(uint16_t code, const ErrorCode& err);
   Instruction *MakeInstruction(uint16_t code, uint32_t k,
                                Instruction *jt, Instruction *jf);
 
   // Join two (sequences of) instructions. This is useful, if the "next"
   // parameter had not originally been given in the call to MakeInstruction(),
   // or if a (conditional) jump still has an unsatisfied target.
   void JoinInstructions(Instruction *head, Instruction *tail);
 
+  // Traverse the graph of instructions and visit each instruction once.
+  // Traversal order is implementation-defined. It is acceptable to make
+  // changes to the graph from within the callback function. These changes
+  // do not affect traversal.
+  // The "fnc" function gets called with both the instruction and the opaque
+  // "aux" pointer.
+  void Traverse(Instruction *, void (*fnc)(Instruction *, void *aux),
+                void *aux);
+
   // Compiles the graph of instructions into a BPF program that can be passed
   // to the kernel. Please note that this function modifies the graph in place
   // and must therefore only be called once per graph.
   void Compile(Instruction *instructions, Sandbox::Program *program);
 
  private:
   friend class CodeGenUnittestHelper;
 
   // Find all the instructions that are the target of BPF_JMPs.
   void FindBranchTargets(const Instruction& instructions,
@@ skipping 48 matching lines @@
   BasicBlocks  basic_blocks_;
 
   // Compile() must only ever be called once as it makes destructive changes
   // to the DAG.
   bool compiled_;
 };
 
 }  // namespace
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__