sandbox: Update known syscalls to kernel 3.17

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 163 matching lines @@
 
   if (SyscallSets::IsKill(sysno)) {
     return RestrictKillTarget(current_pid, sysno);
   }
 
   if (SyscallSets::IsFileSystem(sysno) ||
       SyscallSets::IsCurrentDirectory(sysno)) {
     return Error(fs_denied_errno);
   }
 
+  if (SyscallSets::IsSeccomp(sysno))
+    return Error(EPERM);
+
   if (SyscallSets::IsAnySystemV(sysno)) {
     return Error(EPERM);
   }
 
   if (SyscallSets::IsUmask(sysno) ||
       SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) ||
       SyscallSets::IsDeniedGetOrModifySocket(sysno) ||
       SyscallSets::IsProcessPrivilegeChange(sysno)) {
     return Error(EPERM);
   }
@@ skipping 37 matching lines @@
     DCHECK_EQ(syscall(__NR_getpid), current_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sysno);
 }
 
 ResultExpr BaselinePolicy::InvalidSyscall() const {
   return CrashSIGSYS();
 }
 
 }  // namespace sandbox.