Update from https://crrev.com/328418

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_
 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_
 
 #include <unistd.h>
 
 #include "build/build_config.h"
@@ skipping 49 matching lines @@
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictKillTarget(pid_t target_pid,
                                                       int sysno);
 
 // Crash if FUTEX_CMP_REQUEUE_PI is used in the second argument of futex(2).
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictFutex();
 
 // Crash if |which| is not PRIO_PROCESS. EPERM if |who| is not 0, neither
 // |target_pid| while calling setpriority(2) / getpriority(2).
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid);
 
-// Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime().
-// We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID,
-// CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID.  In particular, this disallows
-// access to arbitrary per-{process,thread} CPU-time clock IDs (such as those
-// returned by {clock,pthread}_getcpuclockid), which can leak information
-// about the state of the host OS.
-// On Chrome OS, base::TimeTicks::kClockSystemTrace is also allowed.
-SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID();
-
 // Restricts |pid| for sched_* syscalls which take a pid as the first argument.
 // We only allow calling these syscalls if the pid argument is equal to the pid
 // of the sandboxed process or 0 (indicating the current thread).  The following
 // syscalls are supported:
 //
 // sched_getaffinity(), sched_getattr(), sched_getparam(), sched_getscheduler(),
 // sched_rr_get_interval(), sched_setaffinity(), sched_setattr(),
 // sched_setparam(), sched_setscheduler()
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictSchedTarget(pid_t target_pid,
                                                        int sysno);
 
 // Restricts the |pid| argument of prlimit64 to 0 (meaning the calling process)
 // or target_pid.
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictPrlimit64(pid_t target_pid);
 
 // Restricts the |who| argument of getrusage to RUSAGE_SELF (meaning the calling
 // process).
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetrusage();
 
+// Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime().
+// We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID,
+// CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID.  In particular, this disallows
+// access to arbitrary per-{process,thread} CPU-time clock IDs (such as those
+// returned by {clock,pthread}_getcpuclockid), which can leak information
+// about the state of the host OS.
+// On Chrome OS, base::TimeTicks::kClockSystemTrace is also allowed.
+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID();
+
 }  // namespace sandbox.
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_