Merge bitcoin/bitcoin#24690: util: Add inotify_rm_watch to syscall sandbox (AllowFileSystem)

f05a4cd util: Add inotify_rm_watch to syscall sandbox (AllowFileSystem) (Hennadii Stepanov)

Pull request description:

  This PR fixes the current master (3297f5c) when running `bitcoin-qt` on Ubuntu 22.04 and quitting:
  ```
  $ ./src/qt/bitcoin-qt -signet -sandbox=log-and-abort
  Warning: Ignoring XDG_SESSION_TYPE=wayland on Gnome. Use QT_QPA_PLATFORM=wayland to run on Wayland anyway.
  ERROR: The syscall "inotify_rm_watch" (syscall number 255) is not allowed by the syscall sandbox in thread "main". Please report.
  terminate called without an active exception
  Aborted (core dumped)
  ```

  Also see bitcoin/bitcoin#24659 (comment)

ACKs for top commit:
  fanquake:
    ACK f05a4cd - checked that qt is using this in it's filesystem watcher code.

Tree-SHA512: 9c7920a25422cd3a040bc1cbc487c12c3dc2b91358c3757f1030d6a1ff12c18c688a8e5b7466f683da88a5e4f5f15d442975660022d706e47021253c24c58f4a

Author: fanquake

src/util/syscall_sandbox.cpp

@@ -592,6 +592,7 @@ class SeccompPolicyBuilder
         allowed_syscalls.insert(__NR_getcwd);          // get current working directory
         allowed_syscalls.insert(__NR_getdents);        // get directory entries
         allowed_syscalls.insert(__NR_getdents64);      // get directory entries
+        allowed_syscalls.insert(__NR_inotify_rm_watch);// remove an existing watch from an inotify instance
         allowed_syscalls.insert(__NR_linkat);          // create relative to a directory file descriptor
         allowed_syscalls.insert(__NR_lstat);           // get file status
         allowed_syscalls.insert(__NR_mkdir);           // create a directory