[linux][sandbox] Allow memfd_create() syscall in GPU process

Some Vulkan implementations, particularly swiftshader and i915 drivers
use memdfd_create() to implement vkGetSemaphoreFdKHR() API. That syscall
was previously enabled only on ChromeOS, which was breaking swiftshader
tests when trying to enable synchronization for some images (see
http://crrev.com/c/2353413 )

Bug: 1115692
Change-Id: Id0898d6d77ad8aa5140ffe34aa7dafbc3fe19249
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2354205
Commit-Queue: Sergey Ulanov <sergeyu@chromium.org>
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Auto-Submit: Sergey Ulanov <sergeyu@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#797886}

sandbox/policy/linux/bpf_gpu_policy_linux.cc

@@ -40,9 +40,7 @@ ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
     case __NR_kcmp:
       return Error(ENOSYS);
-#if defined(OS_CHROMEOS)
-    case __NR_memfd_create:
-#else   // !defined(OS_CHROMEOS)
+#if !defined(OS_CHROMEOS)
     case __NR_fallocate:
 #endif  // defined(OS_CHROMEOS)
     case __NR_ftruncate:
@@ -55,6 +53,7 @@ ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
 #endif
     case __NR_getdents64:
     case __NR_ioctl:
+    case __NR_memfd_create:
       return Allow();
 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
     // The Nvidia driver uses flags not in the baseline policy