python: Fix a typo in a comment

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
python: Fix a crash when resolve_syscall fails

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Add seccomp_sigsys_decode

This will decode a SIGSYS to a struct seccomp_data.  It shows the raw
(untranslated) values as opposed to the translated values.  For example,
socketcall will show up as socketcall.

This supports x86_64, i386, and ARM if the syscall architecture
matches the libseccomp architecture.  It also supports i386 compat
syscalls with a 64-bit libseccomp.  (That is unlikely to happen
without either some kind of thunk library to load 32-bit code into a
64-bit process or explicit invocations of compat syscalls from
64-bit code.)  It should also work on x32, although I haven't tested
it.

(NB: ARM, in theory, supports syscalls with seven arguments.  The
only syscall like this is sys_syscall, which is (AFAICT) only exists
because it's awkward to implement syscall(2) on OABI without it.
seccomp does not, and probably never will, support filtering on the
seventh argument of sys_syscall, and there's little point for us to
have a nasty special case just to be able to decode it..)

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
python: Add set_trap_handler

This provides access to seccomp_decode_sigsys and sigaction(SIGSYS, ...)

You can use it like this:

import os
import pdb
import seccomp
seccomp.set_trap_handler(seccomp.trace_trapped_syscall)
f = seccomp.SyscallFilter(seccomp.ALLOW)
f.add_rule(seccomp.TRAP, 'getgid')
f.load()
def bad():
    os.getgid()
bad()
print 'Unreachable'

This prints:

Dying due to seccomp-blocked syscall getgid(0x0, 0x0, 0x4, 0x0, 0x0, 0x3AD8F13240)
Traceback (most recent call last):
  File "test.py", line 10, in <module>
    bad()
  File "test.py", line 9, in bad
    os.getgid()

(Note: those arguments are bogus.  A considerably fancier future version
 could know the syscall signatures and the mapping from raw to logical
 arguments to allow a nicer message like "... getgid()".  In the mean time,
 this makes debugging much easier.)

Signed-off-by: Andy Lutomirski <luto@amacapital.net>