[Android] Block __NR_getsockname via EPERM rather than SIGSYS.

content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/socket.h>
@@ skipping 138 matching lines @@
     return sandbox::RestrictClockID();
   }
 
 #if defined(__x86_64__)
   if (sysno == __NR_arch_prctl) {
     const Arg<int> code(0);
     return If(code == ARCH_SET_GS, Allow()).Else(Error(EPERM));
   }
 #endif
 
+  // Restrict socket-related operations. On non-i386 platforms, these are
+  // individual syscalls. On i386, the socketcall syscall demultiplexes many
+  // socket operations.
 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
       defined(__mips__)
   if (sysno == __NR_socket) {
     const Arg<int> domain(0);
     const Arg<int> type(1);
     const Arg<int> protocol(2);
     return If(RestrictSocketArguments(domain, type, protocol), Allow())
            .Else(Error(EPERM));
   }
+
+  // https://crbug.com/655300
+  if (sysno == __NR_getsockname) {
+    // Rather than blocking with SIGSYS, just return an error. This is not
+    // documented to be a valid errno, but we will use it anyways.
+    return Error(EPERM);
+  }
 #elif defined(__i386__)
   if (sysno == __NR_socketcall) {
     const Arg<int> socketcall(0);
     const Arg<int> domain(1);
     const Arg<int> type(2);
     const Arg<int> protocol(3);
     return If(socketcall == SYS_CONNECT, Allow())
-           .ElseIf(AllOf(socketcall == SYS_SOCKET,
-                         RestrictSocketArguments(domain, type, protocol)),
-                   Allow())
+           .ElseIf(socketcall == SYS_SOCKET, Allow())
            .ElseIf(socketcall == SYS_GETSOCKOPT, Allow())
            .Else(Error(EPERM));
   }
 #endif
 
   if (override_and_allow)
     return Allow();
 
   return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 }
 
 }  // namespace content