[Android] Get renderers working again under seccomp-bpf.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index 2d3e7dec02343187e6a349164afdf8c31a2fd1dd..7707953f00a71078d42abcd7c268656d35f6fa5f 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
@@ -40,6 +40,16 @@
 #define F_DUPFD_CLOEXEC (F_LINUX_SPECIFIC_BASE + 6)
 #endif
 
+// https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/private/bionic_prctl.h
+#if !defined(PR_SET_VMA)
+#define PR_SET_VMA 0x53564d41
+#endif
+
+// https://android.googlesource.com/platform/system/core/+/lollipop-release/libcutils/sched_policy.c
+#if !defined(PR_SET_TIMERSLACK_PID)
+#define PR_SET_TIMERSLACK_PID 41
+#endif
+
 #endif  // defined(OS_ANDROID)
 
 #if defined(__arm__) && !defined(MAP_STACK)
@@ -129,6 +139,9 @@ ResultExpr RestrictPrctl() {
   return Switch(option)
       .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE),
              Allow())
+#if defined(OS_ANDROID)
+      .CASES((PR_SET_VMA, PR_SET_TIMERSLACK_PID), Allow())

[jln (very slow on Chromium), 2014/12/04 01:35:38]

Any reasonable way to add a unit test here?

Either call set_sched_policy() or figure out what the common caller is (any
thread creation?)

[Robert Sesek, 2014/12/04 17:56:59]

No, I tried. There's no common caller, and most callers are in JNI functions.
set_sched_policy() isn't in the NDK either (it's defined in cutils, which is
private). Similar for all use of PR_SET_VMA.

I can test __NR_set_tid_address, but that's not too interesting, and it's in the
//content-level policy, rather than //sandbox :|

+#endif
       .Default(CrashSIGSYSPrctl());
 }