Add a seccomp rule for the rseq syscall

Executables built with a recent glibc will always try this syscall on
startup. ENOSYS will inform them that it is unavailable.

Author: otargowski

src/seccomp/policy/DefaultPolicy.cc

@@ -86,6 +86,10 @@ void DefaultPolicy::addExecutionControlRules(bool allowFork) {
         rules_.emplace_back(SeccompRule(syscall, action::ActionTrace()));
     }
 
+    for (const auto& syscall: {"rseq"}) {
+        rules_.emplace_back(SeccompRule(syscall, action::ActionErrno(ENOSYS)));
+    }
+
     if (allowFork) {
         allowSyscalls({"fork"});
     }