shared/seccomp: add seccomp_restrict_ptrace()

PTRACE_POKETEXT and PTRACE_POKEDATA use FOLL_FORCE to forcibly write
into a tracee's memory. That includes executable read-only pages. If we
restrict execution to trusted binaries PID 1 must enforce that it's
impossible to abuse this to get untrusted code execution. Note, that
usermodehelpers are not subject to PID 1's seccomp filters.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

src/shared/seccomp-util.h

@@ -122,6 +122,7 @@ static inline int seccomp_restrict_realtime(void) {
         return seccomp_restrict_realtime_full(EPERM);
 }
 int seccomp_memory_deny_write_execute(void);
+int seccomp_restrict_ptrace(void);
 int seccomp_lock_personality(unsigned long personality);
 int seccomp_protect_hostname(void);
 int seccomp_restrict_suid_sgid(void);
@@ -166,6 +167,10 @@ static inline bool is_seccomp_available(void) {
         return false;
 }
 
+static inline int seccomp_restrict_ptrace(void) {
+        return -EOPNOTSUPP;
+}
+
 #endif
 
 int dlopen_libseccomp(int log_level) _dlopen_loader_;