[Android] Do not restrict the arguments to getsockopt.

content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/socket.h>
@@ skipping 111 matching lines @@
 #endif
     case __NR_sysinfo:  // https://crbug.com/655277
     case __NR_uname:
 
     // Permit socket operations so that renderers can connect to logd and
     // debuggerd. The arguments to socket() are further restricted below.
     // Note that on i386, both of these calls map to __NR_socketcall, which
     // is demultiplexed below.
 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
       defined(__mips__)
     case __NR_getsockopt:

[Robert Sesek, 2017/02/03 10:58:50]

This was the regression.

     case __NR_connect:
     case __NR_socket:
 #endif
 
     // Ptrace is allowed so the Breakpad Microdumper can fork in a renderer
     // and then ptrace the parent.
     case __NR_ptrace:
       override_and_allow = true;
       break;
   }
@@ skipping 31 matching lines @@
   }
 
   // https://crbug.com/655300
   if (sysno == __NR_getsockname) {
     // Rather than blocking with SIGSYS, just return an error. This is not
     // documented to be a valid errno, but we will use it anyways.
     return Error(EPERM);
   }
 
   // https://crbug.com/682488
-  if (sysno == __NR_getsockopt || sysno == __NR_setsockopt) {
-    // The baseline policy applies other restrictions to these syscalls.
+  if (sysno == __NR_setsockopt) {
+    // The baseline policy applies other restrictions to setsockopt.
     const Arg<int> level(1);
     const Arg<int> option(2);
     return If(AllOf(level == SOL_SOCKET, option == SO_SNDTIMEO), Allow())
            .Else(SandboxBPFBasePolicy::EvaluateSyscall(sysno));
   }
 #elif defined(__i386__)
   if (sysno == __NR_socketcall) {
     // The baseline policy allows other socketcall sub-calls.
     const Arg<int> socketcall(0);
     return Switch(socketcall)
         .CASES((SYS_CONNECT,
                 SYS_SOCKET,
                 SYS_SETSOCKOPT,
                 SYS_GETSOCKOPT),
                Allow())
         .Default(SandboxBPFBasePolicy::EvaluateSyscall(sysno));
   }
 #endif
 
   if (override_and_allow)
     return Allow();
 
   return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 }
 
 }  // namespace content