[Android] Seccomp whitelist expansion for M58.

content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/socket.h>
@@ skipping 69 matching lines @@
 #endif
 #if defined(__x86_64__) || defined(__aarch64__)
     case __NR_newfstatat:
     case __NR_getdents64:
 #elif defined(__i386__) || defined(__arm__) || defined(__mips__)
     case __NR_fstatat64:
     case __NR_getdents:
 #endif
     case __NR_getpriority:
     case __NR_ioctl:
+#if defined(__i386__)
+    // While mincore is on multiple arches, it is only used on Android by x86.
+    case __NR_mincore:  // https://crbug.com/701137
+#endif
     case __NR_mremap:
 #if defined(__i386__)
     // Used on pre-N to initialize threads in ART.
     case __NR_modify_ldt:
 #endif
     case __NR_msync:
     // File system access cannot be restricted with seccomp-bpf on Android,
     // since the JVM classloader and other Framework features require file
     // access. It may be possible to restrict the filesystem with SELinux.
     // Currently we rely on the app/service UID isolation to create a
@@ skipping 73 matching lines @@
            .Else(Error(EPERM));
   }
 
   // https://crbug.com/655300
   if (sysno == __NR_getsockname) {
     // Rather than blocking with SIGSYS, just return an error. This is not
     // documented to be a valid errno, but we will use it anyways.
     return Error(EPERM);
   }
 
-  // https://crbug.com/682488
+  // https://crbug.com/682488, https://crbug.com/701137
   if (sysno == __NR_setsockopt) {
     // The baseline policy applies other restrictions to setsockopt.
     const Arg<int> level(1);
     const Arg<int> option(2);
-    return If(AllOf(level == SOL_SOCKET, option == SO_SNDTIMEO), Allow())
+    return If(AllOf(level == SOL_SOCKET,
+                    AnyOf(option == SO_SNDTIMEO,
+                          option == SO_RCVTIMEO,
+                          option == SO_REUSEADDR)),
+              Allow())
            .Else(SandboxBPFBasePolicy::EvaluateSyscall(sysno));
   }
 #elif defined(__i386__)
   if (sysno == __NR_socketcall) {
     // The baseline policy allows other socketcall sub-calls.
     const Arg<int> socketcall(0);
     return Switch(socketcall)
         .CASES((SYS_CONNECT,
                 SYS_SOCKET,
                 SYS_SETSOCKOPT,
                 SYS_GETSOCKOPT),
                Allow())
         .Default(SandboxBPFBasePolicy::EvaluateSyscall(sysno));
   }
 #endif
 
   if (override_and_allow)
     return Allow();
 
   return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 }
 
 }  // namespace content