[MIPS] Add seccomp bpf support

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 79b5b023da4f07d429d18fe7a101c684ec7eb381..1ed6d1e9b7abe27347a4c4b8247993af2388c339 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -44,6 +44,9 @@ bool IsBaselinePolicyAllowed(int sysno) {
 #if defined(__arm__)
          SyscallSets::IsArmPrivate(sysno) ||
 #endif
+#if defined(__mips__)
+         SyscallSets::IsMipsSpecific(sysno) ||

[Kees Cook, 2014/05/02 22:06:35]

...Private vs ...Specific ?

[nedeljko, 2014/05/07 15:40:05]

There is no private syscall range on mips like there is on arm.
On the other hand, syscalls from this function are basically the same as
syscalls from IsArmPrivate, so I changed function name to IsMipsPrivate to
adhere to naming convention used for arm.

+#endif
          SyscallSets::IsAllowedOperationOnFd(sysno);
 }
 
@@ -72,12 +75,15 @@ bool IsBaselinePolicyWatched(int sysno) {
 #endif
          SyscallSets::IsNuma(sysno) ||
          SyscallSets::IsProcessGroupOrSession(sysno) ||
-#if defined(__i386__)
+#if defined(__i386__) || defined(__mips__)
          SyscallSets::IsSocketCall(sysno) ||
 #endif
 #if defined(__arm__)
          SyscallSets::IsArmPciConfig(sysno) ||
 #endif
+#if defined(__mips__)
+         SyscallSets::IsMipsMisc(sysno) ||
+#endif
          SyscallSets::IsTimer(sysno);
 }
 
@@ -97,7 +103,7 @@ ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 
-#if defined(__x86_64__) || defined(__arm__)
+#if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
     COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
@@ -115,12 +121,12 @@ ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
                          ErrorCode(EPERM));
   }
 
-#if defined(__i386__) || defined(__x86_64__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
   if (sysno == __NR_mmap)
     return RestrictMmapFlags(sandbox);
 #endif
 
-#if defined(__i386__) || defined(__arm__)
+#if defined(__i386__) || defined(__arm__) || defined(__mips__)
   if (sysno == __NR_mmap2)
     return RestrictMmapFlags(sandbox);
 #endif
@@ -131,7 +137,7 @@ ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
   if (sysno == __NR_fcntl)
     return RestrictFcntlCommands(sandbox);
 
-#if defined(__i386__) || defined(__arm__)
+#if defined(__i386__) || defined(__arm__) || defined(__mips__)
   if (sysno == __NR_fcntl64)
     return RestrictFcntlCommands(sandbox);
 #endif
@@ -156,7 +162,7 @@ ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
     return ErrorCode(EPERM);
   }
 
-#if defined(__i386__)
+#if defined(__i386__) || defined(__mips__)
   if (SyscallSets::IsSocketCall(sysno))
     return RestrictSocketcallCommand(sandbox);
 #endif