Linux Sandbox: Whitelist prlimit64 when used as getrlimit

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index 43f633ed78e398654441e2c182b1614ce0176360..9f1261d4397fd074268bf7756c6e80091df45579 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
@@ -361,4 +361,9 @@ ResultExpr RestrictGetRandom() {
   return If((flags & ~kGoodFlags) == 0, Allow()).Else(CrashSIGSYS());
 }
 
+ResultExpr RestrictPrlimit64ToGetrlimit() {
+  const Arg<uintptr_t> new_limit(0);
+  return If(new_limit == 0, Allow()).Else(Error(EPERM));

[Jorge Lucangeli Obes, 2016/11/21 14:18:43]

Should this also restrict |pid| to the process' PID?

+}
+
 }  // namespace sandbox.