Linux sandbox: restrict prctl in the baseline.

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 5b8badf8300d7fb9744bc4c12698181db9749805..a9fb1044778dd8ab28424bbc8afe1b2191b9f921 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -36,7 +36,6 @@ bool IsBaselinePolicyAllowed(int sysno) {
          SyscallSets::IsAllowedGeneralIo(sysno) ||
          SyscallSets::IsAllowedGetOrModifySocket(sysno) ||
          SyscallSets::IsAllowedGettime(sysno) ||
-         SyscallSets::IsAllowedPrctl(sysno) ||
          SyscallSets::IsAllowedProcessStartOrDeath(sysno) ||
          SyscallSets::IsAllowedSignalHandling(sysno) ||
          SyscallSets::IsGetSimpleId(sysno) ||
@@ -71,6 +70,7 @@ bool IsBaselinePolicyWatched(int sysno) {
          SyscallSets::IsNetworkSocketInformation(sysno) ||
 #endif
          SyscallSets::IsNuma(sysno) ||
+         SyscallSets::IsPrctl(sysno) ||
          SyscallSets::IsProcessGroupOrSession(sysno) ||
 #if defined(__i386__)
          SyscallSets::IsSocketCall(sysno) ||
@@ -145,6 +145,9 @@ ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
   if (sysno == __NR_mprotect)
     return RestrictMprotectFlags(sandbox);
 
+  if (sysno == __NR_prctl)
+    return sandbox::RestrictPrctl(sandbox);
+
 #if defined(__x86_64__) || defined(__arm__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.