seccomp: update "@default" seccomp group a bit

Let's add more of the most basic operations to "@default" as absolute
baseline needed by glibc and such to operate. Specifically:

futex, get_robust_list, get_thread_area, membarrier, set_robust_list,
set_thread_area, set_tid_address are all required to properly implement
mutexes and other thread synchronization logic. Given that a ton of
datastructures are protected by mutexes (such as stdio and such), let's
just whitelist this by default, so that things can just work.

restart_syscall is used to implement EAGAIN SA_RESTART stuff in some
archs, and synthesized by the kernel without any explicit user logic,
hence let's make this work out of the box.

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 643dde6..88e21f6 100644 (file)
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -278,11 +278,19 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "execve\0"
                 "exit\0"
                 "exit_group\0"
+                "futex\0"
+                "get_robust_list\0"
+                "get_thread_area\0"
                 "getrlimit\0"      /* make sure processes can query stack size and such */
                 "gettimeofday\0"
+                "membarrier\0"
                 "nanosleep\0"
                 "pause\0"
+                "restart_syscall\0"
                 "rt_sigreturn\0"
+                "set_robust_list\0"
+                "set_thread_area\0"
+                "set_tid_address\0"
                 "sigreturn\0"
                 "time\0"
         },