On Linux, move the passing of filedescriptors to a dedicated socketpair().

sandbox/linux/seccomp/syscall.cc

 #include "debug.h"
 #include "sandbox_impl.h"
 #include "syscall_table.h"
 
 namespace playground {
 
 // TODO(markus): change this into a function that returns the address of the assembly code. If that isn't possible for sandbox_clone, then move that function into a *.S file
 asm(
     ".pushsection .text, \"ax\", @progbits\n"
 
@@ skipping 185 matching lines @@
 void* Sandbox::defaultSystemCallHandler(int syscallNum, void* arg0, void* arg1,
                                         void* arg2, void* arg3, void* arg4,
                                         void* arg5) {
   // TODO(markus): The following comment is currently not true, we do intercept these system calls. Try to fix that.
 
   // We try to avoid intercepting read(), write(), and sigreturn(), as
   // these system calls are not restricted in Seccomp mode. But depending on
   // the exact instruction sequence in libc, we might not be able to reliably
   // filter out these system calls at the time when we instrument the code.
   SysCalls sys;
-  unsigned long rc;
+  long     rc;
   switch (syscallNum) {
     case __NR_read:
       Debug::syscall(syscallNum, "Allowing unrestricted system call");
       rc             = sys.read((long)arg0, arg1, (size_t)arg2);
       break;
     case __NR_write:
       Debug::syscall(syscallNum, "Allowing unrestricted system call");
       rc             = sys.write((long)arg0, arg1, (size_t)arg2);
       break;
     case __NR_rt_sigreturn:
@@ skipping 32 matching lines @@
         return (void *)-ENOSYS;
       }
   }
   if (rc < 0) {
     rc               = -sys.my_errno;
   }
   return (void *)rc;
 }
 
 } // namespace