Linux sandbox: always restrict clone() in baseline policy.

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 79 matching lines @@
   if (sysno == __NR_sigaltstack) {
     // Required for better stack overflow detection in ASan. Disallowed in
     // non-ASan builds.
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 #endif
   if (IsBaselinePolicyAllowed(sysno)) {
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 
+  if (sysno == __NR_clone) {
+    return RestrictCloneToThreadsAndEPERMFork(sandbox);
+  }
+
 #if defined(__x86_64__) || defined(__arm__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
     COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
     return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX,
                          ErrorCode(ErrorCode::ERR_ALLOWED),
                          sandbox->Trap(CrashSIGSYS_Handler, NULL));
   }
 #endif
 
@@ skipping 80 matching lines @@
 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox,
                                           int sysno) const {
   // Make sure that this policy is used in the creating process.
   if (1 == sysno) {
     DCHECK_EQ(syscall(__NR_getpid), current_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno);
 }
 
 }  // namespace sandbox.