Linux sandbox: always restrict clone() in baseline policy.

sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 
 #include "build/build_config.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 namespace sandbox {
@@ skipping 332 matching lines @@
 #endif
       return true;
     default:
       return false;
   }
 }
 
 // This should be thought through in conjunction with IsFutex().
 bool SyscallSets::IsAllowedProcessStartOrDeath(int sysno) {
   switch (sysno) {
-    case __NR_clone:  // TODO(jln): restrict flags.
     case __NR_exit:
     case __NR_exit_group:
     case __NR_wait4:
     case __NR_waitid:
 #if defined(__i386__)
     case __NR_waitpid:
 #endif
       return true;
+    case __NR_clone:  // Should be parameter-restricted.
     case __NR_setns:  // Privileged.
     case __NR_fork:
 #if defined(__i386__) || defined(__x86_64__)
     case __NR_get_thread_area:
     case __NR_set_thread_area:
 #endif
     case __NR_set_tid_address:
     case __NR_unshare:
     case __NR_vfork:
     default:
@@ skipping 599 matching lines @@
     case __ARM_NR_usr26:
     case __ARM_NR_usr32:
       return true;
     default:
       return false;
   }
 }
 #endif  // defined(__arm__)
 
 }  // namespace sandbox.