Linux sandbox: restrict setpriority() in baseline policy.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index 4ccacdb30ef3351e3a59e899a0e5db1c3f38302f..a75865f6530da5b97c5e0df1577a896e202ed4a8 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
@@ -14,7 +14,9 @@
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
+#include <sys/resource.h>
 #include <sys/stat.h>
+#include <sys/time.h>
 #include <sys/types.h>
 #include <unistd.h>
 
@@ -242,4 +244,12 @@ ResultExpr RestrictFutex() {
       .Default(CrashSIGSYSFutex());
 }
 
+bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid) {

[mdempsky, 2014/09/11 17:40:24]

There's a "using bpf_dsl::ResultExpr" declaration in this file, so you can use
just "ResultExpr" here.

[jln (very slow on Chromium), 2014/09/11 17:46:32]

Done.

+  const Arg<int> which(0);
+  const Arg<int> who(1);
+  return If(which == PRIO_PROCESS,
+            If(who == 0 || who == target_pid, Allow()).Else(Error(EPERM)))
+      .Else(CrashSIGSYS());
+}
+
 }  // namespace sandbox.