Found in strace of tor startup. We definitely need these.

• clone
• eventfd2
• futex Called from CRYPTO_THREAD_run_once -> __pthread_once_slow
• getrandom Called a few places in libcrypto.
• recvmsg Used with sa_family=AF_NETLINK, which is a way of
  communicating with the system kernel. Called from
  tor(get_interface_addresses_raw) -> libc(getifaddrs). We're planning to
  implement in the shim-side implementation of getifaddrs without implementing
  this AF_NETLINK mechanism.
• set_tid_address Called from pthread(__pthread_initialize_minimal)
• [moved to Support multi-threaded plugins #826] set_robust_list Might be able to get away without emulating, but should
  take a closer look when supporting threading, futex, etc. Called from
  pthread(__pthread_initialize_minimal)
• prlimit64 Called from tor(set_max_file_descriptors). Only observed with pid=0. Might be sufficient to
  just check for pid=0, and if so allow to execute natively, and if not return not implemented.
• prctl

Found in tor/src/lib/sandbox/sandbox.c (but not in the above dynamic trace). We probably need these too.

• fcntl64 (may be defined on some platforms)
• getsockopt
• kill Looks like it's configured to only work with signal=0; i.e. check
  for process existence, but not actually send a signal.
• mmap2 (may be defined on some platforms)
• setsockopt
• socketpair
• time

Found in strace of shadow-plugin-tor integration test (but not in the above).
We probably need these too, though it's possible some of these syscalls were only made by shadow itself, and not on behalf of one of the plugins in the simulation.

• gettimeofday

May only need to handle for determinism:

• sysinfo Called from libssl(SSL_rstate_string) -> libc(qsort_r).