Outdated docs on "Ubuntu security tips" for seccomp

[Jose Alvarado]

The Ubuntu security tips doc has outdated information:

"The same process as above holds for seccomp except the seccomp policy is in /var/lib/snapd/seccomp/profiles/snap.<name>.<command> and there is no command to load the policy (you simply have to relaunch the command or snap run --shell). The seccomp policy language is considerably simpler and is essentially a list of allowed syscalls."

As covered in https://github.com/snapcore/snapd/wiki/snap-confine-Overview, Seccomp profiles are now located in /var/lib/snapd/seccomp/bpf/.

Furthermore, it's wrong to say that the seccomp profile doesn't need to be explicitly loaded. The profile source (the *.src file in the profile directory) needs to be recompiled into the profile binary (*.bin in the profile directory) as detailed in this Snapcraft forum post: https://forum.snapcraft.io/t/seccomp-profile-not-compiling/16792.

[Jamie Strandboge (jdstrand)]

This should be covered by the new https://forum.snapcraft.io/t/debugging-snaps/18420 doc and the revamped https://forum.snapcraft.io/t/security-policy-and-sandboxing/554 which refers to it. Thanks Graham!