Linux sandbox: Disallow get_robust_list and set_robust_list.

sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
index de6ba24f1e5c2de2c1ad66235ae1ca2849fea877..f619ecbd2704e82cfb0436d17528859d92447ef1 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
@@ -400,9 +400,7 @@ bool SyscallSets::IsAllowedProcessStartOrDeath(int sysno) {
 // It's difficult to restrict those, but there is attack surface here.
 bool SyscallSets::IsAllowedFutex(int sysno) {
   switch (sysno) {
-    case __NR_get_robust_list:
     case __NR_set_robust_list:
-      return true;
     case __NR_futex:
     default:
       return false;

[jln (very slow on Chromium), 2014/09/15 23:37:46]

Can you put __NR_get_robust_list here (before default:) ?

The untold rule of this file is that we're making sure to list every syscalls
here. That way people can easily see that we don't consider get_robust_list an
allowed futex operation.