sandbox: Update known syscalls to kernel 3.17

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 145 matching lines @@
   if (sysno == __NR_mmap2)
     return RestrictMmapFlags();
 #endif
 
   if (sysno == __NR_mprotect)
     return RestrictMprotectFlags();
 
   if (sysno == __NR_prctl)
     return sandbox::RestrictPrctl();
 
+  if (SyscallSets::IsSeccomp(sysno))
+    return Error(EPERM);

[jln (very slow on Chromium), 2014/08/22 00:05:17]

I know that this function is getting quite messy, but normally the order should
be:

- What we allow
- What we restrict
- What we EPERM
- What crashes.

Do you mind moving this below, with the other EPERM stuff?

+
 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
     COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
     const Arg<int> domain(0);
     return If(domain == AF_UNIX, Allow()).Else(CrashSIGSYS());
   }
 #endif
 
   if (SyscallSets::IsKill(sysno)) {
@@ skipping 55 matching lines @@
     DCHECK_EQ(syscall(__NR_getpid), current_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sysno);
 }
 
 ResultExpr BaselinePolicy::InvalidSyscall() const {
   return CrashSIGSYS();
 }
 
 }  // namespace sandbox.