seccomp: Make mode a bitmask

Make seccomp mode into a bitmask so that modes can be combined.
Only a single mode can be activated at a time, but when multiple
modes are active, the most restrictive result across all of the
modes is used.

Note that seccomp mode 1 generates SIGKILL whereas SECCOMP_RET_KILL
generates SIGSYS; ensure that behavior is preserved (and that
SIGKILL trumps SIGSYS if both are indicated).

Signed-off-by: David Drysdale <drysdale@google.com>
seccomp: Add self-test for dual seccomp mode

Test that seccomp-strict mode and seccomp-bpf mode can
be combined.

Signed-off-by: David Drysdale <drysdale@google.com>
seccomp: Add extended actions

Roll up Kees Cook's patch sequence into a single commit.
 - Add lock around task_struct.seccomp.filter
 - Set seccomp mode inside lock
 - Move no_new_privs into seccomp
 - Add SECCOMP_EXT_ACT options
seccomp: add selftest of SECCOMP_EXT_ACT options

Repeat the tests that enter seccomp-bpf mode via
SECCOMP_MODE_FILTER, but enter via the SECCOMP_EXT_ACT,
SECCOMP_EXT_ACT_FILTER method instead.

Check whether pre-existing additional threads are appropriately
affected by the seccomp BPF program.

Signed-off-by: David Drysdale <drysdale@google.com>
seccomp: add seccomp mode that invokes LSM hook

If CONFIG_SECCOMP_LSM is defined, support an additional seccomp
mode where each syscall is policed by a new .intercept_syscall
LSM hook; the hook takes the syscall arguments and returns a
BPF response code indicating what action to take.  The default
implementation of the hook always returns SECCOMP_RET_ALLOW.

As with installing seccomp-bpf filters, enabling the seccomp
LSM mode requires that a task either has the CAP_SYS_ADMIN
capability, or that it has previously set no_new_privs.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: add capability mode to filter syscalls

Add a default implementation of the new .intercept_syscall LSM
hook for Capsicum capability mode.  This mode disables all system
calls that access global namespaces, such as the filesystem or
IP:ports.

Add the ECAPMODE errno value to indicate that a particular syscall
has been rejected due to capability mode.

The set of allowed syscalls is intended to be as close as possible
to those allowed in the FreeBSD 10.x implementation of Capsicum, to
ease the porting of Capsicum-aware applications.

Signed-off-by: David Drysdale <drysdale@google.com>