Linux Sandbox: Whitelist prlimit64 when used as getrlimit

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
 #include <linux/net.h>
@@ skipping 343 matching lines @@
 #if !defined(GRND_NONBLOCK)
 #define GRND_NONBLOCK 1
 #endif
 
 ResultExpr RestrictGetRandom() {
   const Arg<unsigned int> flags(2);
   const unsigned int kGoodFlags = GRND_NONBLOCK;
   return If((flags & ~kGoodFlags) == 0, Allow()).Else(CrashSIGSYS());
 }
 
+ResultExpr RestrictPrlimitToGetrlimit(pid_t target_pid) {
+  const Arg<pid_t> pid(0);
+  const Arg<uintptr_t> new_limit(2);
+  // Only allow 'get' operations, and only for the current process.
+  return If(AllOf(new_limit == 0, AnyOf(pid == 0, pid == target_pid)), Allow())
+      .Else(Error(EPERM));
+}
+
 }  // namespace sandbox.