Linux sandbox: restrict clock_gettime() and clock_getres()

sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
index f55df035c6032427dcac5b4f88d0caab66ab18cf..98548568ff0c296244ba81a2bb95c457b95b847b 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
@@ -17,6 +17,7 @@
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 #include "base/files/scoped_file.h"
@@ -336,6 +337,14 @@ BPF_DEATH_TEST_C(BaselinePolicy,
   _exit(1);
 }
 
+BPF_DEATH_TEST_C(BaselinePolicy,
+                 ClockGettimeWithDisallowedClockCrashes,
+                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 BaselinePolicy) {
+  struct timespec ts;
+  clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
+}
+
 }  // namespace
 
 }  // namespace sandbox