Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
index 1570114c012ac4dc5ddd563c6a4286ba5e6b1f82..2ad07a36a2bfee4d5d4ad325cb41ea02a7c0bb8c 100644 |
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
@@ -166,6 +166,8 @@ GpuProcessPolicy::~GpuProcessPolicy() {} |
ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, |
int sysno) const { |
switch (sysno) { |
+ // TODO(jln): restrict clone. |
+ case __NR_clone: |
case __NR_ioctl: |
#if defined(__i386__) || defined(__x86_64__) |
// The Nvidia driver uses flags not in the baseline policy |