Linux sandbox: restrict futex operations.

sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
index 0b6acb5fe0487280cd4b6e24cecddaab1c7ec979..c42fa54419273707a25da67f7b9d8d0c9a9162c4 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
@@ -5,12 +5,14 @@
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
+#include <linux/futex.h>
 #include <sched.h>
 #include <signal.h>
 #include <string.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
+#include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
@@ -241,6 +243,23 @@ TEST_BASELINE_SIGSYS(__NR_getcpu);
 TEST_BASELINE_SIGSYS(__NR_setpgid);
 TEST_BASELINE_SIGSYS(__NR_getitimer);
 
+BPF_DEATH_TEST_C(BaselinePolicy,
+                 FutexWithRequeuePriorityInheritence,
+                 DEATH_MESSAGE(GetErrorMessageContentForTests()),
+                 BaselinePolicy) {
+  syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI, 0, NULL, NULL, 0);
+  _exit(1);
+}
+
+BPF_DEATH_TEST_C(BaselinePolicy,
+                 FutexWithBannedBit,
+                 DEATH_MESSAGE(GetErrorMessageContentForTests()),
+                 BaselinePolicy) {
+  syscall(__NR_futex, NULL, 512 | FUTEX_WAKE , 0, NULL, NULL, 0);
+  _exit(1);
+}
+
+
 }  // namespace
 
 }  // namespace sandbox