seccomp: handle arch inversion II
seccomp: handle arch inversion II

LXC generates and loads the seccomp-bpf filter in the host/container which
spawn the new container. In other words, userspace N is responsible for
generating and loading the seccomp-bpf filter which restricts userspace N + 1.
Assume 64bit kernel and 32bit userspace running a 64bit container. In this case
the 32-bit x86 userspace is used to create a seccomp-bpf filter for a 64-bit
userspace. Unless one explicitly adds the 64-bit ABI to the libseccomp filter,
or adjusts the default behavior for "BAD_ARCH", *all* 64-bit x86 syscalls will
be blocked.

Signed-off-by: Christian Brauner <48455ab3070520a2d174545c7239d6d0fabd9a83@ubuntu.com>
Suggested-by: Paul Moore <a027184a55211cd23e3f3094f1fdc728df5e0500@paul-moore.com>

ss1h2a3tw/lxc,ss1h2a3tw/lxc,hallyn/lxc,hallyn/lxc,caglar10ur/lxc,caglar10ur/lxc,ss1h2a3tw/lxc,caglar10ur/lxc,hallyn/lxc