Linux sandbox: EPERM ioctl in NaCl's outer sandbox

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
index c0ee0125a5e5b9ba79597a84581ba5f1347de19f..73adfd3503876be7af176e1189a684db574455e6 100644
--- a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
@@ -67,8 +67,6 @@ ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
     // NaCl uses custom signal stacks.
     case __NR_sigaltstack:
     // Below is fairly similar to the policy for a Chromium renderer.
-    // TODO(jln): restrict ioctl() and prctl().
-    case __NR_ioctl:
 #if defined(__i386__) || defined(__x86_64__)
     case __NR_getrlimit:
 #endif
@@ -95,6 +93,7 @@ ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
     case __NR_times:
     case __NR_uname:
       return ErrorCode(ErrorCode::ERR_ALLOWED);
+    case __NR_ioctl:
     case __NR_ptrace:
       return ErrorCode(EPERM);
     default: