policybuilder: Add convenience function AllowInotify for the inotify API.

This change introduces a new `PolicyBuilder::AllowInotify()` method that permits the full inotify API, including `inotify_init`, `inotify_init1`, `inotify_add_watch`, `inotify_rm_watch`, and close. The existing `AllowInotifyInit()` only covers the initialization syscalls and will be removed in a second step.

PiperOrigin-RevId: 800042599
Change-Id: I0b775af1450fc49e03b63a4e30ed46cb4e55e411

Author: okunz

sandboxed_api/sandbox2/policybuilder.cc

@@ -303,6 +303,24 @@ PolicyBuilder& PolicyBuilder::AllowInotifyInit() {
   });
 }
 
+PolicyBuilder& PolicyBuilder::AllowInotify() {
+  return AllowSyscalls({
+#ifdef __NR_inotify_init
+      __NR_inotify_init,
+#endif
+#ifdef __NR_inotify_init1
+      __NR_inotify_init1,
+#endif
+#ifdef __NR_inotify_add_watch
+      __NR_inotify_add_watch,
+#endif
+#ifdef __NR_inotify_rm_watch
+      __NR_inotify_rm_watch,
+#endif
+      __NR_close,
+  });
+}
+
 PolicyBuilder& PolicyBuilder::AllowSelect() {
   return AllowSyscalls({
 #ifdef __NR_select

sandboxed_api/sandbox2/policybuilder.h

@@ -239,6 +239,16 @@ class PolicyBuilder final {
   // - inotify_init1
   PolicyBuilder& AllowInotifyInit();
 
+  // Appends code to allow the inotify API.
+  //
+  // Allows these syscalls:
+  // - inotify_init
+  // - inotify_init1
+  // - inotify_add_watch
+  // - inotify_rm_watch
+  // - close
+  PolicyBuilder& AllowInotify();
+
   // Appends code to allow synchronous I/O multiplexing.
   //
   // Allows these syscalls: