content: bpf: exclude the syscalls if arm64

content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc

Index: content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc
diff --git a/content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc
index de0a89f5ed9d16ac485cc356d215fe9ca61a3286..6bc903bb1d229d4bce1c7275a2aa3b80a7e5363a 100644
--- a/content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc
+++ b/content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc
@@ -108,8 +108,10 @@ class CrosArmGpuBrokerProcessPolicy : public CrosArmGpuProcessPolicy {
 // openat allowed.
 ResultExpr CrosArmGpuBrokerProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
+#if !defined(aarch64)
     case __NR_access:

[mdempsky, 2014/12/07 03:46:40]

Do we need to allow __NR_accessat or something else?

[cometzero, 2014/12/07 06:47:38]

Hmm. There is no __NR_access on the arm64. Maybe __NR_faccessat can be used
instead of it.

[leecam, 2014/12/07 17:08:24]

Yep __NR_faccessat is the replacement for __NR_access.
In sandbox/linux/syscall_broker/broker_host.cc you'll see a sys_open function
that wraps 'open' so we ensure we directly call __NR_openat. It might be worth
doing something similar for __NR_access and explicitly calling the faccessat
syscall then only allowing that in the policy. That should work across all of
our supported architectures.

     case __NR_open:
+#endif // !defined(aarch64)
     case __NR_openat:
       return Allow();
     default: