AllowRestartableSequences: Add whole /proc

Adding `/proc/self/cpuset` is not really correct.

PiperOrigin-RevId: 899797242
Change-Id: I08c6e51e4c8c23ba43dfa81893f8e0c7fcf574fe

Author: Sandboxed API Team

sandboxed_api/sandbox2/policybuilder.cc

@@ -1128,12 +1128,14 @@ PolicyBuilder& PolicyBuilder::AllowRestartableSequences(
                                             });
     AllowPrctlSetVma();
 
-    AddDirectoryIfNamespaced("/proc");
+    AddFileIfNamespaced("/proc/cpuinfo");
+    AddFileIfNamespaced("/proc/stat");
     AddDirectoryIfNamespaced("/sys/devices/system/cpu");
   }
   if (cpu_fence_mode == kAllowSlowFences && !allowed_complex_.slow_fences) {
     AllowSyscall(__NR_sched_getaffinity);
     AllowSyscall(__NR_sched_setaffinity);
+    AddFileIfNamespaced("/proc/self/cpuset");
     allowed_complex_.slow_fences = true;
   } else if (cpu_fence_mode == kRequireFastFences) {
     allowed_complex_.fast_fences = true;