tree cece2c8934775dbad87cd9128932dfc39ca655c9
parent 714d2e84b90ea1425310f1b231dad6a9c6a122f0
author Matthew Denton <mpdenton@chromium.org> 1645213281 +0000
committer Copybara-Service <copybara-worker@google.com> 1645214223 -0800

[Linux sandbox] Fix current seccomp failures

pidfd_open is a syscall new in Linux 5.3. For some reason we are
getting seccomp crashes for it, even though it's unused in chromium
and glibc. Just return ENOSYS instead of crashing, and any code should
be able to handle its nonexistence for backwards compatibility.

We are also getting a lot of seccomp crashes for sched_getaffinity.
There isn't enough reason to block it, so allow it (restricted to the
current process) in the utility and service sandboxes.

Bug: 758557
Change-Id: I0d7354839be37912f35068dfacfaf78c35e894b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3472467
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Commit-Queue: Matthew Denton <mpdenton@chromium.org>
Cr-Commit-Position: refs/heads/main@{#973068}
NOKEYCHECK=True
GitOrigin-RevId: b2ea904d412adfeba5ff24f59497d659b2329a20