sandbox: Update known syscalls to kernel 3.17

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 7f4d5590cf86616b006ccc4b04571710deb9c939..333be6f9a18db8f7d61214aaa65b484b914fcb1c 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -52,7 +52,8 @@ bool IsBaselinePolicyAllowed(int sysno) {
 #if defined(__mips__)
          SyscallSets::IsMipsPrivate(sysno) ||
 #endif
-         SyscallSets::IsAllowedOperationOnFd(sysno);
+         SyscallSets::IsAllowedOperationOnFd(sysno) ||
+         SyscallSets::IsSeccomp(sysno);

[jln (very slow on Chromium), 2014/08/21 23:38:01]

We should not allow this system call in general. This opens a lot of attack
surface.

[leecam, 2014/08/21 23:57:13]

Yeah I guess once its set we shouldn't allow it again. I've changed it to
disallow. 

On 2014/08/21 23:38:01, jln wrote:

 }
 
 // System calls that will trigger the crashing SIGSYS handler.