Non-SFI NaCl: Allow openat system call to gracefully fail on BareMetal seccomp-bpf.

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/prctl.h>
@@ skipping 144 matching lines @@
     case __NR_getgid32:
     case __NR_getuid32:
 #endif
     case __NR_getegid:
     case __NR_geteuid:
     case __NR_getgid:
     case __NR_getuid:
     // tcmalloc calls madvise in TCMalloc_SystemRelease.
     case __NR_madvise:
     // EPERM instead of SIGSYS as glibc tries to open files in /proc.
+    // openat via opendir via get_nprocs_conf and open via get_nprocs.
     // TODO(hamaji): Remove this when we switch to newlib.
     case __NR_open:
+    case __NR_openat:
     // For RunSandboxSanityChecks().
     case __NR_ptrace:
     // glibc uses this for its pthread implementation. If we return
     // EPERM for this, glibc will stop using this.
     // TODO(hamaji): newlib does not use this. Make this SIGTRAP once
     // we have switched to newlib.
     case __NR_set_robust_list:
     // This is obsolete in ARM EABI, but x86 glibc indirectly calls
     // this in sysconf.
 #if defined(__i386__) || defined(__x86_64__)
@@ skipping 128 matching lines @@
       scoped_ptr<sandbox::SandboxBPFPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl