Linux sandbox: always restrict clone() in baseline policy.

sandbox/linux/sandbox_linux_test_sources.gypi

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Tests need to be compiled in the same link unit, so we have to list them
 # in a separate .gypi file.
 {
   'dependencies': [
     'sandbox',
     'sandbox_linux_test_utils',
@@ skipping 13 matching lines @@
     'services/yama_unittests.cc',
   ],
   'conditions': [
     [ 'compile_suid_client==1', {
       'sources': [
         'suid/client/setuid_sandbox_client_unittest.cc',
       ],
     }],
     [ 'use_seccomp_bpf==1', {
       'sources': [
+        'seccomp-bpf-helpers/baseline_policy_unittest.cc',
         'seccomp-bpf/bpf_tests_unittest.cc',
         'seccomp-bpf/codegen_unittest.cc',
         'seccomp-bpf/errorcode_unittest.cc',
         'seccomp-bpf/sandbox_bpf_unittest.cc',
         'seccomp-bpf/syscall_iterator_unittest.cc',
         'seccomp-bpf/syscall_unittest.cc',
       ],
     }],
     [ 'compile_credentials==1', {
       'sources': [
         'services/credentials_unittest.cc',
         'services/unix_domain_socket_unittest.cc',
       ],
     }],
   ],
 }