Linux sandbox: restrict clock_gettime() and clock_getres()

sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
index c0a720a3b6fb0bf86d2c6c1fdf6e1b4c086530ba..de6ba24f1e5c2de2c1ad66235ae1ca2849fea877 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
@@ -27,7 +27,6 @@ bool SyscallSets::IsKill(int sysno) {
 
 bool SyscallSets::IsAllowedGettime(int sysno) {
   switch (sysno) {
-    case __NR_clock_gettime:
     case __NR_gettimeofday:
 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
     case __NR_time:
@@ -36,6 +35,7 @@ bool SyscallSets::IsAllowedGettime(int sysno) {
     case __NR_adjtimex:         // Privileged.
     case __NR_clock_adjtime:    // Privileged.
     case __NR_clock_getres:     // Could be allowed.
+    case __NR_clock_gettime:
     case __NR_clock_nanosleep:  // Could be allowed.
     case __NR_clock_settime:    // Privileged.
 #if defined(__i386__) || defined(__mips__)