make SYS_fork non-fatal, musl uses it for fork(2)

--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -1253,6 +1253,10 @@
         // usually do something reasonable on error.
       case __NR_clone:
         return ClonePolicy(Error(EPERM));
+#ifdef __NR_fork
+      case __NR_fork:
+        return Error(ENOSYS);
+#endif
 
 #  ifdef __NR_fadvise64
       case __NR_fadvise64:

upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1657849
diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp
index ed958bc..9824433 100644
--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -1751,6 +1751,6 @@ class GMPSandboxPolicy : public SandboxPolicyCommon {
       case __NR_sched_get_priority_max:
+      case __NR_sched_setscheduler:
         return Allow();
       case __NR_sched_getparam:
-      case __NR_sched_getscheduler:
-      case __NR_sched_setscheduler: {
+      case __NR_sched_getscheduler: {
         Arg<pid_t> pid(0);
@@ -1926,3 +1926,2 @@ class RDDSandboxPolicy final : public SandboxPolicyCommon {
       case __NR_sched_getscheduler:
-      case __NR_sched_setscheduler:
       case __NR_sched_getattr:
@@ -1932,2 +1931,5 @@ class RDDSandboxPolicy final : public SandboxPolicyCommon {
       }
+      // sched_setscheduler gets special treatment here (bug 1657849):
+      case __NR_sched_setscheduler:
+        return Allow();