Linux sandbox: always restrict clone() in baseline policy.

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
 
 #include <errno.h>
 #include <signal.h>
 #include <sys/ptrace.h>
 
@@ skipping 56 matching lines @@
 
  private:
   scoped_ptr<SandboxBPFPolicy> baseline_policy_;
   DISALLOW_COPY_AND_ASSIGN(NaClBPFSandboxPolicy);
 };
 
 ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
     sandbox::SandboxBPF* sb, int sysno) const {
   DCHECK(baseline_policy_);
   switch (sysno) {
+    case __NR_clone:  // TODO(jln): restrict parameters.
     // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
     // see if it can be restricted a bit.
 #if defined(__x86_64__) || defined(__arm__)
     // transport_common.cc needs this.
     case __NR_accept:
     case __NR_setsockopt:
 #elif defined(__i386__)
     case __NR_socketcall:
 #endif
     // trusted/service_runtime/linux/thread_suspension.c needs sigwait() and is
@@ skipping 82 matching lines @@
       scoped_ptr<SandboxBPFPolicy>(new NaClBPFSandboxPolicy()));
   if (sandbox_is_initialized) {
     RunSandboxSanityChecks();
     return true;
   }
 #endif  // defined(USE_SECCOMP_BPF)
   return false;
 }
 
 }  // namespace nacl