NonSFI sandbox: restrict futex(2) operations.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
 #include <linux/futex.h>
@@ skipping 211 matching lines @@
       return CrashSIGSYSKill();
     default:
       NOTREACHED();
       return CrashSIGSYS();
   }
 }
 
 ResultExpr RestrictFutex() {
   const int kAllowedFutexFlags = FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME;
   const int kOperationMask = ~kAllowedFutexFlags;
-
   const Arg<int> op(1);
   return Switch(op & kOperationMask)
       .CASES((FUTEX_WAIT,
               FUTEX_WAKE,
-              FUTEX_FD,
               FUTEX_REQUEUE,
               FUTEX_CMP_REQUEUE,
               FUTEX_WAKE_OP,
               FUTEX_WAIT_BITSET,
               FUTEX_WAKE_BITSET),
              Allow())
       .Default(CrashSIGSYSFutex());
 }
 
 }  // namespace sandbox.