seccomp: adding new syscalls (bugzilla 855162)

According to the bug 855162[0] - there's the need of adding new syscalls
to the whitelist when using Qemu with Libvirt.

[0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162

v2: Adding new syscalls to the list: readlink, rt_sigpending, and
    rt_sigtimedwait

v3: Adding new syscalls based on further tests.

Reported-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
seccomp: support for "double whitelist" filters

This patch includes a second whitelist right before the main loop. It's
a smaller and more restricted whitelist, excluding execve() among many
others.

v2: * ctx changed to main_loop_ctx
    * seccomp_on now inside ifdef
    * open() syscall added to the main_loop whitelist

v3: * Main loop is now the same as the init loop except that execve
      is removed.  We plan to make efforts to reduce this list in
      the future.
    * Use enum seccomp_states, seccomp_get_state(), and
      seccomp_install_filter()

Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
net: Disallow device hotplug that causes execve()

We'll soon be introducing a second whitelist that prevents
execve() right before the main_loop() is entered.  In preparation,
we need to gracefully disable use of exec'd scripts/binaries when
hotplugging network devices.  For example, the following will not
be allowed:

netdev_add tap,id=tapdev0
netdev_add bridge
host_net_add tap
host_net_add bridge

v2: * Error messages moved to the backend function, net_init_tap(),
      recommended by Paolo Bonzini
    * Documentation added to QMP and HMP commands, and also to the Qemu
    * options.

v3: * Prevent hotplug of network devices only when execve() would be
      called by checking seccomp_get_state(). (pbonzini@redhat.com)
    * Update enum seccomp_states with new states for 2 whitelists.
    * Remove #ifdef preprocesser tests where possible
      (pbonzini@redhat.com)
    * Update network monitor and -sandbox command line documentation.

Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
seccomp: support for "double whitelist" filters

This patch includes a second whitelist right before the main loop. It's
a smaller and more restricted whitelist, excluding execve() among many
others.

v2: * ctx changed to main_loop_ctx
    * seccomp_on now inside ifdef
    * open() syscall added to the main_loop whitelist

v3: * Main loop is now the same as the init loop except that execve
      is removed.  We plan to make efforts to reduce this list in
      the future.
    * Use enum seccomp_states, seccomp_get_state(), and
      seccomp_install_filter()

Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
seccomp: adding debug mode

This patch is meant for developer debug purposes only.  It adds
support that displays the offending system call number if QEMU
is being killed by seccomp.  The offending system call may need
to be added to the appropriate system call white list in
qemu-seccomp.c to prevent seccomp from killing QEMU.

When the seccomp filter is configured with SCMP_ACT_TRAP, the
kernel sends a SIGSYS every time an illegal syscall is called.
The role of the debug mode is to handle the SIGSYS, determine
the illegal syscall, and print the syscall number to stderr.

v3: New in v3.

Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>