Linux Sandbox: Whitelist prlimit64 when used as getrlimit

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_
 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_
 
 #include <unistd.h>
 
 #include "build/build_config.h"
@@ skipping 80 matching lines @@
 // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID.  In particular, this disallows
 // access to arbitrary per-{process,thread} CPU-time clock IDs (such as those
 // returned by {clock,pthread}_getcpuclockid), which can leak information
 // about the state of the host OS.
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID();
 
 // Restrict the flags argument to getrandom() to allow only no flags, or
 // GRND_NONBLOCK.
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetRandom();
 
+// Restrict the new_limit argument to prlimit64() to NULL, and the pid argument

[Jorge Lucangeli Obes, 2016/11/22 16:06:39]

"only allow only" -> "only allow"

+// to the current process (or 0), to only allow only getting rlimits on the
+// current process.  Otherwise, fail gracefully; see crbug.com/160157.
+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictPrlimitToGetrlimit(pid_t target_pid);
+
 }  // namespace sandbox.
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_