Allow getrandom syscall for HwAsan builds

Sandboxed API Team · copybara-github · commit 8697eeeced1a · 2026-05-05T11:49:12.000-07:00
PiperOrigin-RevId: 910821035
Change-Id: I5353b7277ba7d7cb0fa3c9c74a682ff1c18393f5
diff --git a/sandboxed_api/sandbox2/policybuilder.cc b/sandboxed_api/sandbox2/policybuilder.cc
@@ -596,6 +596,9 @@ PolicyBuilder& PolicyBuilder::AllowLlvmSanitizers() {
   if constexpr (sapi::sanitizers::IsASan()) {
     AllowSyscall(__NR_sigaltstack);
   }
+  if constexpr (sapi::sanitizers::IsHwASan()) {
+    AllowGetRandom();
+  }
   if constexpr (sapi::sanitizers::IsTSan()) {
     AllowSyscall(__NR_set_robust_list);
   }

Original file line number	Diff line number	Diff line change
`@@ -596,6 +596,9 @@ PolicyBuilder& PolicyBuilder::AllowLlvmSanitizers() {`
`596`	`596`	`if constexpr (sapi::sanitizers::IsASan()) {`
`597`	`597`	`AllowSyscall(__NR_sigaltstack);`
`598`	`598`	`}`
	`599`	`+ if constexpr (sapi::sanitizers::IsHwASan()) {`
	`600`	`+ AllowGetRandom();`
	`601`	`+ }`
`599`	`602`	`if constexpr (sapi::sanitizers::IsTSan()) {`
`600`	`603`	`AllowSyscall(__NR_set_robust_list);`
`601`	`604`	`}`