Non-SFI mode:Suid sandbox.

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
index 5c4fa4224f7c2d0efbb4d203911da1286cb40fbb..a350ec4b6a1016789ca359a864b9bf3f124750a3 100644
--- a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
@@ -96,6 +96,9 @@ void NaClSandbox::InitializeLayerOneSandbox() {
   }
 }
 
+#if !defined(OS_NACL_NONSFI)
+// Currently Layer-two sandbox is not yet supported on nacl_helper_nonsfi.
+// TODO(hidehiko): Enable the sandbox.
 void NaClSandbox::CheckForExpectedNumberOfOpenFds() {

[Mark Seaborn, 2015/02/06 20:15:03]

Technically, CheckForExpectedNumberOfOpenFds() isn't part of the layer-two
(seccomp) sandbox.  This check is useful when we only have the layer-one (SUID)
sandbox enabled too.

Does CheckForExpectedNumberOfOpenFds() fail at run-time in nacl_helper_nonsfi,
or does it fail to link?  Maybe you could say in the comment which of the two
applies.

[hidehiko, 2015/03/02 19:16:25]

No, but it is only called from InitializeLayerTwoSandbox() so I exclude it.
Ditto for above methods. (Note that some of above methods contains PNaCl
toolchian unsupported code. I'll address it later).

   if (setuid_sandbox_client_->IsSuidSandboxChild()) {
     // We expect to have the following FDs open:
@@ -131,6 +134,7 @@ void NaClSandbox::InitializeLayerTwoSandbox(bool uses_nonsfi_mode) {
     layer_two_enabled_ = nacl::InitializeBPFSandbox(proc_self_task.Pass());
   }
 }
+#endif  // OS_NACL_NONSFI
 
 void NaClSandbox::SealLayerOneSandbox() {
   if (!layer_two_enabled_) {
@@ -162,6 +166,9 @@ void NaClSandbox::CheckSandboxingStateWithPolicy() {
       LOG(FATAL) << kNoSuidMsg << kItIsNotAllowedMsg;
   }
 
+#if !defined(OS_NACL_NONSFI)
+  // Currently Layer-two sandbox is not yet supported on nacl_helper_nonsfi.
+  // TODO(hidehiko): Enable the sandbox.
   if (!layer_two_enabled_) {
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
@@ -170,6 +177,7 @@ void NaClSandbox::CheckSandboxingStateWithPolicy() {
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
+#endif
 }
 
 }  // namespace nacl