upstart: Add global seccomp policy mechanism
Add a global seccomp policy file to upstart that defines the global
denylist policy. Link the generated bpf file into upstart to be
used as the seccomp filter for all processes if the seccomp use flag is
set.
BUG=b:197662591
TEST=emerge and deploy and check that calling the blocked syscall throws
the expected error.
Cq-Depend: chromium:3119824
Change-Id: I74d5c8248cfdb1fcf38839916b0ebf57ef0e69e4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/upstart/+/2934717
Tested-by: Nicole Anderson-Au <nvaa@google.com>
Auto-Submit: Nicole Anderson-Au <nvaa@google.com>
Reviewed-by: Allen Webb <allenwebb@google.com>
Commit-Queue: Allen Webb <allenwebb@google.com>
7 files changed
