Add SandboxBPFPolicy::InvalidSyscall() to simplify writing policies

sandbox/linux/seccomp-bpf/verifier.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string.h>
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h"
 #include "sandbox/linux/seccomp-bpf/verifier.h"
@@ skipping 369 matching lines @@
 #if defined(__x86_64__) && defined(__ILP32__)
     if (!(sysnum & 0x40000000u)) {
       continue;
     }
 #else
     if (sysnum & 0x40000000u) {
       continue;
     }
 #endif
 #endif
-    ErrorCode code = policy.EvaluateSyscall(sandbox, sysnum);
+    ErrorCode code = iter.IsValid(sysnum)
+                         ? policy.EvaluateSyscall(sandbox, sysnum)
+                         : policy.InvalidSyscall(sandbox);
     if (!VerifyErrorCode(sandbox, program, &data, code, code, err)) {
       return false;
     }
   }
   return true;
 }
 
 uint32_t Verifier::EvaluateBPF(const std::vector<struct sock_filter>& program,
                                const struct arch_seccomp_data& data,
                                const char** err) {
@@ skipping 36 matching lines @@
         break;
       default:
         *err = "Unexpected instruction in BPF program";
         break;
     }
   }
   return 0;
 }
 
 }  // namespace sandbox