Allow for seccomp blacklist rather than whitelisting

[Stéphane Graber]

LXD, LXC and quite probably Docker would benefit from the ability to define a syscall blacklist rather than a whitelist.

This would be to block known harmful syscalls but still allow EVERYTHING else, including syscalls which are not yet known to snappy or seccomp.

This would be done as a blacklist BPF filter and NOT as a whitelist of all other syscalls, which wouldn't work as it would only ever cover things that were known at the time seccomp or snappy were built and so would block anything newer.

[Zygmunt Krynicki (zyga)]

I think this is doable with a few tweaks to snap-confine and snapd. Please ack the design with jdstrand and niemayer and I can implement this.

[Jamie Strandboge (jdstrand)]

Thank you for filing a bug, as mentioned in the PR, this isn't strictly required for lxd and docker and isn't needed at all for the transitional policy that we've decided should use @unrestricted. As such, marking as wishlist.

[Stéphane Graber (stgraber)]

Agreed, this is a wishlist as a way to add an extra safety net under lxc, lxd, docker at some point in the future, @unconfined will do fine for now.