sandbox: Update known syscalls to kernel 3.17

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 34 matching lines @@
          SyscallSets::IsAllowedProcessStartOrDeath(sysno) ||
          SyscallSets::IsAllowedSignalHandling(sysno) ||
          SyscallSets::IsGetSimpleId(sysno) ||
          SyscallSets::IsKernelInternalApi(sysno) ||
 #if defined(__arm__)
          SyscallSets::IsArmPrivate(sysno) ||
 #endif
 #if defined(__mips__)
          SyscallSets::IsMipsPrivate(sysno) ||
 #endif
-         SyscallSets::IsAllowedOperationOnFd(sysno);
+         SyscallSets::IsAllowedOperationOnFd(sysno) ||
+         SyscallSets::IsSeccomp(sysno);

[jln (very slow on Chromium), 2014/08/21 23:38:01]

We should not allow this system call in general. This opens a lot of attack
surface.

[leecam, 2014/08/21 23:57:13]

Yeah I guess once its set we shouldn't allow it again. I've changed it to
disallow. 

On 2014/08/21 23:38:01, jln wrote:

 }
 
 // System calls that will trigger the crashing SIGSYS handler.
 bool IsBaselinePolicyWatched(int sysno) {
   return SyscallSets::IsAdminOperation(sysno) ||
          SyscallSets::IsAdvancedScheduler(sysno) ||
          SyscallSets::IsAdvancedTimer(sysno) ||
          SyscallSets::IsAsyncIo(sysno) ||
          SyscallSets::IsDebug(sysno) ||
          SyscallSets::IsEventFd(sysno) ||
@@ skipping 165 matching lines @@
     DCHECK_EQ(syscall(__NR_getpid), current_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sysno);
 }
 
 ResultExpr BaselinePolicy::InvalidSyscall() const {
   return CrashSIGSYS();
 }
 
 }  // namespace sandbox.