sandbox: Update known syscalls to kernel 3.17

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

Index: sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 7f4d5590cf86616b006ccc4b04571710deb9c939..1f34c925a79280738a53b4147a0888a73d227b56 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -163,6 +163,9 @@ ResultExpr EvaluateSyscallImpl(int fs_denied_errno,
   if (sysno == __NR_prctl)
     return sandbox::RestrictPrctl();
 
+  if (SyscallSets::IsSeccomp(sysno))
+    return Error(EPERM);

[jln (very slow on Chromium), 2014/08/22 00:05:17]

I know that this function is getting quite messy, but normally the order should
be:

- What we allow
- What we restrict
- What we EPERM
- What crashes.

Do you mind moving this below, with the other EPERM stuff?

+
 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.