Linux Sandbox: whitelist arm64 syscalls

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
 
 #include <utility>
 
 #include "base/macros.h"
 #include "build/build_config.h"
@@ skipping 88 matching lines @@
   }
 
   switch (sysno) {
 #if defined(__i386__) || defined(__mips__)
     // Needed on i386 to set-up the custom segments.
     case __NR_modify_ldt:
 #endif
     // NaCl uses custom signal stacks.
     case __NR_sigaltstack:
     // Below is fairly similar to the policy for a Chromium renderer.
-#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \
+    defined(__aarch64__)

[Mark Seaborn, 2016/02/26 20:25:30]

This implies that we support running this NaCl code on ARM64, which isn't the
case, so it's a bit misleading to add this.  I assume you just added this for
consistency with the other files?

     case __NR_getrlimit:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_ugetrlimit:
 #endif
     // NaCl runtime uses flock to simulate POSIX behavior for pwrite.
     case __NR_flock:
     case __NR_pread64:
     case __NR_pwrite64:
     case __NR_sched_get_priority_max:
@@ skipping 51 matching lines @@
       std::move(proc_fd));
   if (sandbox_is_initialized) {
     RunSandboxSanityChecks();
     return true;
   }
 #endif  // defined(USE_SECCOMP_BPF)
   return false;
 }
 
 }  // namespace nacl