seccomp: skip redundant rules

[kolyshkin]

This fixes using runc with podman on my system (Fedora 34).

$ podman --runtime $(pwd)/runc run --rm --memory 4M fedora echo it works
Error: unable to start container process: error adding seccomp filter rule for syscall bdflush: permission denied: OCI permission denied

The problem is, libseccomp returns EPERM when a redundant rule (i.e. the
rule with the same action as the default one) is added, and podman (on
my machine) sets the following rules in config.json:

    ....
    "seccomp": {
      "defaultAction": "SCMP_ACT_ERRNO",
      "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
      ],
      "syscalls": [
        {
          "names": [
            "bdflush",
            "io_pgetevents",
            ....
          ],
          "action": "SCMP_ACT_ERRNO",
          "errnoRet": 1
        },
        ....

(Note that defaultErrnoRet is not set, but it defaults to 1).

With this commit, it works:

$ podman --runtime $(pwd)/runc run --memory 4M fedora echo it works
it works

Similar crun commit:

• containers/crun@08229f3fb904c5ea19a7d9

Fixes: #1847
See also: containers/podman#11031

Changelog entry

Bugfixes:
* Redundant seccomp rules (i.e. those that has action equal to the default
  one) are now skipped. This fixes the inability to start a container with
  the "adding seccomp filter rule for syscall ..." error.

1.0 backport: #3129

[kolyshkin]

@opencontainers/runc-maintainers PTAL; this is a P0 as runc is rendered totally useless.

[cyphar]

Please change the warning for unknown syscalls to a debug message. As for the rest of the patch, LGTM (though this seems like it's a bug in podman not in runc, but since the old behaviour is kind brittle and is not defined in the spec, I'm okay with working around it anyway).

[kolyshkin]

this seems like it's a bug in podman

Yes, it is (and it is being fixed).

But there were also older bug reports with the same diagnostics (not sure how they

since the old behaviour is kind brittle and is not defined in the spec

I think it is defined in spec (see the last paragraph in #1847 description ... and yes, we need a CI job to run those tools, I'll get around to it later).

addressed

[cyphar]

LGTM.

[cyphar]

Probably needs a changelog entry too.

[kolyshkin]

Probably needs a changelog entry too.

Added