Linux Sandbox: Whitelist prlimit64 when used as getrlimit

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h

Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
index d2a6faadb6ddb36c9beb18a665353f0a5606febd..d6cca657b5550573d00279868071a42d2c5b7baf 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
@@ -98,6 +98,10 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID();
 // GRND_NONBLOCK.
 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetRandom();
 
+// Restrict the new_limit argument to prlimit64() to NULL to only allow
+// getting rlimits.  Otherwise, fail gracefully; see crbug.com/160157.
+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictPrlimit64ToGetrlimit();
+
 }  // namespace sandbox.
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_