Make building seccomp-bpf a GYP condition

components/nacl/loader/nacl_sandbox_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <signal.h>
 #include <sys/ptrace.h>
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "build/build_config.h"
+
+#if defined(USE_SECCOMP_BPF)
 #include "content/public/common/sandbox_init.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 using sandbox::ErrorCode;
 using sandbox::SandboxBPF;
 using sandbox::SandboxBPFPolicy;
 
 namespace {
@@ skipping 118 matching lines @@
   errno = 0;
   // Make a ptrace request with an invalid PID.
   long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL);
   CHECK_EQ(-1, ptrace_ret);
   // Without the sandbox on, this ptrace call would ESRCH instead.
   CHECK_EQ(EPERM, errno);
 }
 
 }  // namespace
 
+#else
+
+#if !defined(ARCH_CPU_MIPS_FAMILY)
+#error "Seccomp-bpf disabled on supported architecture!"
+#endif  // !!defined(ARCH_CPU_MIPS_FAMILY)

[Mark Seaborn, 2013/12/18 08:10:21]

Nit: Just "!defined" (but a closing comment is rather superfluous when the
opening #if is two lines away!)

[jln (very slow on Chromium), 2013/12/19 00:00:19]

Done.

+
+#endif  // defined(USE_SECCOMP_BPF)
+
 bool InitializeBPFSandbox() {
+#if defined(USE_SECCOMP_BPF)
   bool sandbox_is_initialized = content::InitializeSandbox(
       scoped_ptr<SandboxBPFPolicy>(new NaClBPFSandboxPolicy()));
   if (sandbox_is_initialized) {
     RunSandboxSanityChecks();
     return true;
   }
+#endif  // defined(USE_SECCOMP_BPF)
   return false;

[Mark Seaborn, 2013/12/18 08:10:21]

Hmm, as an aside (which does not affect this change), InitializeBPFSandbox()
returning false isn't treated as a fatal error by BecomeNaClLoader().  That
seems risky.  If the seccomp sandbox broke, would the NaCl tests detect it?

[jln (very slow on Chromium), 2013/12/19 00:00:19]

No, and it was a clear TODO (crbug.com/270914), but I didn't get to it yet.

I need to figure out how to wire reporting the about:sandbox status  to NaCl.

A CHECK() on CHROMEOS might "just work" though.

 }