sandbox: Add Arm64 support for seccomp-BPF

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 1a6bec503fcfc5124bc4d778af0bc38c31486043..07753f537a5abbcd6b3bb540d973269fed5f8d20 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -124,6 +124,13 @@ ResultExpr EvaluateSyscallImpl(int fs_denied_errno,
     return RestrictCloneToThreadsAndEPERMFork();
   }
 
+#if defined(__aarch64__)
+  // These are needed for thread creation.
+  // TODO(leecam): Check jln's fix for this and remove these 'allows'.
+  if (sysno == __NR_sigaltstack || sysno == __NR_setpriority)
+    return Allow();

[jln (very slow on Chromium), 2014/08/22 20:11:30]

Nit: can y ou move this above with the other allow, before the section with
"Restrict*" ?

[leecam, 2014/08/24 22:11:57]

Done.

+#endif
+
   if (sysno == __NR_fcntl)
     return RestrictFcntlCommands();
 
@@ -132,11 +139,13 @@ ResultExpr EvaluateSyscallImpl(int fs_denied_errno,
     return RestrictFcntlCommands();
 #endif
 
+#if !defined(__aarch64__)
   // fork() is never used as a system call (clone() is used instead), but we
   // have seen it in fallback code on Android.
   if (sysno == __NR_fork) {
     return Error(EPERM);
   }
+#endif
 
   if (sysno == __NR_futex)
     return RestrictFutex();
@@ -147,7 +156,8 @@ ResultExpr EvaluateSyscallImpl(int fs_denied_errno,
     return If(advice == MADV_DONTNEED, Allow()).Else(Error(EPERM));
   }
 
-#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \
+    defined(__aarch64__)
   if (sysno == __NR_mmap)
     return RestrictMmapFlags();
 #endif
@@ -163,7 +173,8 @@ ResultExpr EvaluateSyscallImpl(int fs_denied_errno,
   if (sysno == __NR_prctl)
     return sandbox::RestrictPrctl();
 
-#if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
+#if defined(__x86_64__) || defined(__arm__) || defined(__mips__) || \
+    defined(__aarch64__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
     COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);