Implement Seccomp Notify

This commit implements support for the SCMP_ACT_NOTIFY action. It
requires libseccomp-2.5.0 to work but runc still works with older
libseccomp if the seccomp policy does not use the SCMP_ACT_NOTIFY
action.

A new synchronization step between runc[INIT] and runc run is introduced
to pass the seccomp fd. runc run fetches the seccomp fd with pidfd_get
from the runc[INIT] process and sends it to the seccomp agent using
SCM_RIGHTS.

As suggested by @kolyshkin, we also make writeSync() a wrapper of
writeSyncWithFd() and wrap the error there. To avoid pointless errors,
we made some existing code paths just return the error instead of
re-wrapping it. If we don't do it, error will look like:

	writing syncT <act>: writing syncT: <err>

By adjusting the code path, now they just look like this
	writing syncT <act>: <err>

Signed-off-by: Alban Crequy <alban@kinvolk.io>
Signed-off-by: Rodrigo Campos <rodrigo@kinvolk.io>
Co-authored-by: Rodrigo Campos <rodrigo@kinvolk.io>

libcontainer/sync.go

@@ -22,16 +22,22 @@ type syncType string
 //
 // procReady   --> [final setup]
 //             <-- procRun
+//
+// procSeccomp --> [pick up seccomp fd with pidfd_getfd()]
+//             <-- procSeccompDone
 const (
-	procError  syncType = "procError"
-	procReady  syncType = "procReady"
-	procRun    syncType = "procRun"
-	procHooks  syncType = "procHooks"
-	procResume syncType = "procResume"
+	procError       syncType = "procError"
+	procReady       syncType = "procReady"
+	procRun         syncType = "procRun"
+	procHooks       syncType = "procHooks"
+	procResume      syncType = "procResume"
+	procSeccomp     syncType = "procSeccomp"
+	procSeccompDone syncType = "procSeccompDone"
 )
 
 type syncT struct {
 	Type syncType `json:"type"`
+	Fd   int      `json:"fd"`
 }
 
 // initError is used to wrap errors for passing them via JSON,
@@ -47,7 +53,16 @@ func (i initError) Error() string {
 // writeSync is used to write to a synchronisation pipe. An error is returned
 // if there was a problem writing the payload.
 func writeSync(pipe io.Writer, sync syncType) error {
-	return utils.WriteJSON(pipe, syncT{sync})
+	return writeSyncWithFd(pipe, sync, -1)
+}
+
+// writeSyncWithFd is used to write to a synchronisation pipe. An error is
+// returned if there was a problem writing the payload.
+func writeSyncWithFd(pipe io.Writer, sync syncType, fd int) error {
+	if err := utils.WriteJSON(pipe, syncT{sync, fd}); err != nil {
+		return fmt.Errorf("writing syncT %q: %w", string(sync), err)
+	}
+	return nil
 }
 
 // readSync is used to read from a synchronisation pipe. An error is returned