linux/seccomp: allow newfstatat and statx syscalls
linux/seccomp: allow newfstatat and statx syscalls

On Fedora 34 with glibc 2.32.9000, newfstatat is used to get properties
about stdout, on x86_64:

    newfstatat(1, "", {st_mode=000, st_size=0, ...}, AT_EMPTY_PATH) = 262
    --- SIGSYS {si_signo=SIGSYS, si_code=SYS_SECCOMP,
    si_call_addr=0x7fddbb6f56fe, si_syscall=__NR_newfstatat,
    si_arch=AUDIT_ARCH_X86_64} ---

After allowing it:

    newfstatat(1, "", {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}, AT_EMPTY_PATH) = 0
    brk(NULL)                 = 0x561064edd000
    brk(0x561064efe000)       = 0x561064efe000
    brk(NULL)                 = 0x561064efe000
    write(1, "Hello, from a seccomp-filtered world!\n", 38) = 38
    getcwd(0x7ffc48a62070, 4096) = -1 EPERM (Operation not permitted)
    write(1, "getcwd failed as expected.\n", 27) = 27

On x86_32:

    statx(1, "", AT_STATX_SYNC_AS_STAT|AT_NO_AUTOMOUNT|AT_EMPTY_PATH,
    STATX_BASIC_STATS, {stx_mask=0, stx_attributes=0,
    stx_mode=000, stx_size=0, ...}) = 383
    --- SIGSYS {si_signo=SIGSYS, si_code=SYS_SECCOMP,
    si_call_addr=0xf7f55549, si_syscall=__NR_statx,
    si_arch=AUDIT_ARCH_I386} ---

While at it, restrict *stat to stdout only.

fishilico/shared,fishilico/shared,fishilico/shared,fishilico/shared,fishilico/shared,fishilico/shared,fishilico/shared