generate/seccomp: Allow Landlock syscalls

Landlock is a Linux feature that enables creating security sandboxes
(see https://docs.kernel.org/userspace-api/landlock.html).  Allow the
three related system calls (available since Linux 5.13):
landlock_create_ruleset, landlock_add_rule, and
landlock_restrict_self.

Signed-off-by: Mickaël Salaün <[email protected]>

Author: l0kod

generate/seccomp/seccomp_default.go

@@ -151,6 +151,9 @@ func DefaultProfile(rs *specs.Spec) *rspec.LinuxSeccomp {
 				"io_submit",
 				"ipc",
 				"kill",
+				"landlock_add_rule",
+				"landlock_create_ruleset",
+				"landlock_restrict_self",
 				"lchown",
 				"lchown32",
 				"lgetxattr",