SECCOMP-BPF: Added support for greylisting of system calls.

sandbox/linux/seccomp-bpf/codegen.cc

Index: sandbox/linux/seccomp-bpf/codegen.cc
diff --git a/sandbox/linux/seccomp-bpf/codegen.cc b/sandbox/linux/seccomp-bpf/codegen.cc
index 8b36315cff43bd4dd1d6b1fcb539d2a5b55b72ed..649793c079f492826ed86e5864dd67cfcfd73dd6 100644
--- a/sandbox/linux/seccomp-bpf/codegen.cc
+++ b/sandbox/linux/seccomp-bpf/codegen.cc
@@ -5,6 +5,31 @@
 #include "sandbox/linux/seccomp-bpf/codegen.h"
 
 
+namespace {
+
+// Helper function for Traverse().
+void TraverseRecursively(std::set<playground2::Instruction *> *visited,
+                         playground2::Instruction *instruction) {
+  if (visited->find(instruction) == visited->end()) {
+    visited->insert(instruction);
+    switch (BPF_CLASS(instruction->code)) {
+    case BPF_JMP:
+      if (BPF_OP(instruction->code) != BPF_JA) {
+        TraverseRecursively(visited, instruction->jf_ptr);
+      }
+      TraverseRecursively(visited, instruction->jt_ptr);
+      break;
+    case BPF_RET:
+      break;
+    default:
+      TraverseRecursively(visited, instruction->next);
+      break;
+    }
+  }
+}
+
+}  // namespace
+
 namespace playground2 {
 
 CodeGen::CodeGen()
@@ -145,6 +170,17 @@ void CodeGen::JoinInstructions(Instruction *head, Instruction *tail) {
   return;
 }
 
+void CodeGen::Traverse(Instruction *instruction,
+                       void (*fnc)(Instruction *, void *), void *aux) {
+  std::set<Instruction *> visited;
+  TraverseRecursively(&visited, instruction);
+  for (std::set<Instruction *>::const_iterator iter = visited.begin();
+       iter != visited.end();
+       ++iter) {
+    fnc(*iter, aux);
+  }
+}
+
 void CodeGen::FindBranchTargets(const Instruction& instructions,
                                 BranchTargets *branch_targets) {
   // Follow all possible paths through the "instructions" graph and compute